RTF Doc. Uses CVE-2017-8759 Exploit to Execute Code

Monitored Processes

Behavior Information - Grouped by Category

Process #1: winword.exe

(Host: 244, Network: 20)

Information	Value
ID	#1
File Name	c:\program files\microsoft office\root\office16\winword.exe
Command Line	"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"
Initial Working Directory	C:\Users\aETAdzjz\Desktop\
Monitor	Start Time: 00:00:31, Reason: Analysis Target
Unmonitor	End Time: 00:02:36, Reason: Terminated by Timeout
Monitor Duration	00:02:05

OS Process Information

Information	Value
PID	0x9b0
Parent PID	0x52c (c:\windows\explorer.exe)
Is Created or Modified Executable
Integrity Level	Medium
Username	YKYD69Q\aETAdzjz
Groups	YKYD69Q\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) BUILTIN\Administrators (USE_FOR_DENY_ONLY) BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\Logon Session 00000000:00010989 (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID) LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x A68 0x A64 0x A54 0x A30 0x A2C 0x A28 0x A24 0x A20 0x 9F4 0x 9DC 0x 9D0 0x 9CC 0x 9C4 0x 9BC 0x 9B4 0x B04 0x B08 0x B0C 0x B18 0x B24 0x B28 0x B2C 0x B54 0x B58 0x B5C 0x 0 0x B60 0x B64 0x B68 0x BD0 0x BD4 0x 95C

Region

Name	Start VA	End VA	Type	Permissions	Actions
pagefile_0x0000000000010000	0x00010000	0x0001ffff	Pagefile Backed Memory	Readable, Writable	Region Actions
pagefile_0x0000000000020000	0x00020000	0x00020fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000030000	0x00030000	0x00033fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000040000	0x00040000	0x00043fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000000050000	0x00050000	0x0014ffff	Private Memory	Readable, Writable	Region Actions
pagefile_0x0000000000150000	0x00150000	0x00150fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000000160000	0x00160000	0x00160fff	Private Memory	Readable, Writable	Region Actions
private_0x0000000000170000	0x00170000	0x00170fff	Private Memory	Readable, Writable	Region Actions
pagefile_0x0000000000180000	0x00180000	0x00180fff	Pagefile Backed Memory	Readable, Writable	Region Actions
private_0x0000000000190000	0x00190000	0x0028ffff	Private Memory	Readable, Writable	Region Actions
locale.nls	0x00290000	0x002f6fff	Memory Mapped File	Readable	Region Actions
pagefile_0x0000000000300000	0x00300000	0x00306fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000310000	0x00310000	0x00311fff	Pagefile Backed Memory	Readable, Writable	Region Actions
private_0x0000000000320000	0x00320000	0x00320fff	Private Memory	Readable, Writable	Region Actions
private_0x0000000000330000	0x00330000	0x00330fff	Private Memory	Readable, Writable	Region Actions
pagefile_0x0000000000340000	0x00340000	0x00341fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000350000	0x00350000	0x00351fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000360000	0x00360000	0x00362fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000000370000	0x00370000	0x0037ffff	Private Memory	-	Region Actions
private_0x0000000000380000	0x00380000	0x0038ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000000390000	0x00390000	0x0048ffff	Private Memory	Readable, Writable	Region Actions
pagefile_0x0000000000490000	0x00490000	0x00617fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000620000	0x00620000	0x007a0fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x00000000007b0000	0x007b0000	0x01baffff	Pagefile Backed Memory	Readable	Region Actions
sortdefault.nls	0x01bb0000	0x01e7efff	Memory Mapped File	Readable	Region Actions
pagefile_0x0000000001e80000	0x01e80000	0x02272fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000002280000	0x02280000	0x0237ffff	Private Memory	Readable, Writable	Region Actions
pagefile_0x0000000002380000	0x02380000	0x02382fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000002390000	0x02390000	0x02392fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x00000000023a0000	0x023a0000	0x023a2fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x00000000023b0000	0x023b0000	0x023b2fff	Pagefile Backed Memory	Readable	Region Actions
private_0x00000000023c0000	0x023c0000	0x023fffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000002400000	0x02400000	0x02407fff	Private Memory	Readable, Writable	Region Actions
pagefile_0x0000000002410000	0x02410000	0x02411fff	Pagefile Backed Memory	Readable	Region Actions
kernelbase.dll.mui	0x02420000	0x024dffff	Memory Mapped File	Readable, Writable	Region Actions
private_0x00000000024e0000	0x024e0000	0x024e0fff	Private Memory	Readable, Writable	Region Actions
private_0x00000000024f0000	0x024f0000	0x0256ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000002570000	0x02570000	0x02570fff	Private Memory	Readable, Writable	Region Actions
private_0x0000000002580000	0x02580000	0x02580fff	Private Memory	Readable, Writable	Region Actions
private_0x0000000002590000	0x02590000	0x02590fff	Private Memory	Readable, Writable	Region Actions
private_0x0000000002590000	0x02590000	0x0259efff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000025a0000	0x025a0000	0x025a0fff	Private Memory	Readable, Writable	Region Actions
private_0x00000000025b0000	0x025b0000	0x025bffff	Private Memory	Readable, Writable	Region Actions
pagefile_0x00000000025c0000	0x025c0000	0x0269efff	Pagefile Backed Memory	Readable	Region Actions
private_0x00000000026a0000	0x026a0000	0x026c7fff	Private Memory	Readable, Writable	Region Actions
private_0x00000000026d0000	0x026d0000	0x0273afff	Private Memory	Readable, Writable	Region Actions
private_0x0000000002720000	0x02720000	0x02721fff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x0000000002740000	0x02740000	0x02744fff	Pagefile Backed Memory	Readable, Writable	Region Actions
pagefile_0x0000000002750000	0x02750000	0x02750fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000002760000	0x02760000	0x02760fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000002770000	0x02770000	0x02770fff	Private Memory	Readable, Writable	Region Actions
pagefile_0x0000000002780000	0x02780000	0x02781fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000002790000	0x02790000	0x0279ffff	Private Memory	Readable, Writable	Region Actions
devobj.dll	0x027a0000	0x027b9fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msxml6r.dll	0x027c0000	0x027c0fff	Memory Mapped File	Readable	Region Actions
pagefile_0x00000000027d0000	0x027d0000	0x027d0fff	Pagefile Backed Memory	Readable, Writable	Region Actions
private_0x00000000027e0000	0x027e0000	0x028dffff	Private Memory	Readable, Writable	Region Actions
{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000011.db	0x028e0000	0x028fefff	Memory Mapped File	Readable	Region Actions
private_0x0000000002900000	0x02900000	0x02900fff	Private Memory	Readable, Writable	Region Actions
private_0x0000000002910000	0x02910000	0x0298ffff	Private Memory	Readable, Writable	Region Actions
pagefile_0x0000000002990000	0x02990000	0x02991fff	Pagefile Backed Memory	Readable	Region Actions
c_1255.nls	0x029a0000	0x029b0fff	Memory Mapped File	Readable	Region Actions
private_0x00000000029d0000	0x029d0000	0x029dffff	Private Memory	Readable, Writable	Region Actions
segoeuil.ttf	0x029e0000	0x02a30fff	Memory Mapped File	Readable	Region Actions
private_0x0000000002a10000	0x02a10000	0x02a10fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002a20000	0x02a20000	0x02a20fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002a20000	0x02a20000	0x02a3efff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002a30000	0x02a30000	0x02a30fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002a50000	0x02a50000	0x02b4ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000002b50000	0x02b50000	0x02b6ffff	Private Memory	-	Region Actions
private_0x0000000002b80000	0x02b80000	0x02c7ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000002c70000	0x02c70000	0x02c70fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002c80000	0x02c80000	0x02e7ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000002e80000	0x02e80000	0x02fb1fff	Private Memory	Readable, Writable	Region Actions
private_0x0000000002e80000	0x02e80000	0x02f7ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002f80000	0x02f80000	0x02f80fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002f90000	0x02f90000	0x02f90fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002fa0000	0x02fa0000	0x02fa0fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002fa0000	0x02fa0000	0x02faffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002fb0000	0x02fb0000	0x02fb0fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002fc0000	0x02fc0000	0x030bffff	Private Memory	Readable, Writable	Region Actions
private_0x00000000030c0000	0x030c0000	0x030defff	Private Memory	Readable, Writable	Region Actions
private_0x00000000030e0000	0x030e0000	0x031dffff	Private Memory	Readable, Writable	Region Actions
private_0x00000000031e0000	0x031e0000	0x032dffff	Private Memory	Readable, Writable	Region Actions
private_0x00000000032e0000	0x032e0000	0x033dffff	Private Memory	Readable, Writable	Region Actions
pagefile_0x00000000033e0000	0x033e0000	0x03bdffff	Pagefile Backed Memory	Readable, Writable	Region Actions
private_0x0000000003be0000	0x03be0000	0x03ddffff	Private Memory	Readable, Writable	Region Actions
staticcache.dat	0x03de0000	0x0470ffff	Memory Mapped File	Readable	Region Actions
segoeui.ttf	0x04710000	0x0478efff	Memory Mapped File	Readable	Region Actions
private_0x0000000004790000	0x04790000	0x04790fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000047a0000	0x047a0000	0x0489ffff	Private Memory	Readable, Writable	Region Actions
private_0x00000000048a0000	0x048a0000	0x0499ffff	Private Memory	Readable, Writable	Region Actions
private_0x00000000049a0000	0x049a0000	0x049a0fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000049b0000	0x049b0000	0x04aaffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000004ab0000	0x04ab0000	0x04acffff	Private Memory	-	Region Actions
private_0x0000000004af0000	0x04af0000	0x04beffff	Private Memory	Readable, Writable	Region Actions
seguisb.ttf	0x04bf0000	0x04c53fff	Memory Mapped File	Readable	Region Actions
private_0x0000000004c60000	0x04c60000	0x04c6ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000004c90000	0x04c90000	0x04c90fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000004ca0000	0x04ca0000	0x04ca0fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000004cb0000	0x04cb0000	0x04cb0fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000004cc0000	0x04cc0000	0x04cc0fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000004cd0000	0x04cd0000	0x04dcffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000004dd0000	0x04dd0000	0x04dd0fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000004de0000	0x04de0000	0x04de0fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000004df0000	0x04df0000	0x04df0fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000004e00000	0x04e00000	0x04e7ffff	Private Memory	Readable, Writable, Executable	Region Actions
pagefile_0x0000000004e80000	0x04e80000	0x0567ffff	Pagefile Backed Memory	Readable, Writable	Region Actions
private_0x0000000005680000	0x05680000	0x05680fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000005690000	0x05690000	0x05690fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000056a0000	0x056a0000	0x056a0fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000056b0000	0x056b0000	0x056b0fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000056c0000	0x056c0000	0x056c0fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000056d0000	0x056d0000	0x056d0fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000056e0000	0x056e0000	0x057dffff	Private Memory	Readable, Writable	Region Actions
private_0x00000000057e0000	0x057e0000	0x058dffff	Private Memory	Readable, Writable	Region Actions
private_0x00000000058e0000	0x058e0000	0x058e0fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000058e0000	0x058e0000	0x058fefff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000058f0000	0x058f0000	0x058f0fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000005900000	0x05900000	0x05900fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000005910000	0x05910000	0x05910fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000005920000	0x05920000	0x05920fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000005930000	0x05930000	0x059affff	Private Memory	Readable, Writable	Region Actions
private_0x00000000059b0000	0x059b0000	0x059b0fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000059c0000	0x059c0000	0x059c0fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000059d0000	0x059d0000	0x05a4ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000005a50000	0x05a50000	0x05a50fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000005a50000	0x05a50000	0x05a6efff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000005a60000	0x05a60000	0x05a60fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000005a70000	0x05a70000	0x05a70fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000005a80000	0x05a80000	0x05a8ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000005a90000	0x05a90000	0x05e8ffff	Private Memory	Readable, Writable	Region Actions
pagefile_0x0000000005e90000	0x05e90000	0x06e8ffff	Pagefile Backed Memory	Readable, Writable	Region Actions
private_0x0000000006e90000	0x06e90000	0x06e90fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000006e90000	0x06e90000	0x06eb0fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000006ea0000	0x06ea0000	0x06ea0fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000006eb0000	0x06eb0000	0x06eb0fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000006ec0000	0x06ec0000	0x06ec0fff	Private Memory	Readable, Writable	Region Actions Download Dump
arial.ttf	0x06f40000	0x06ffcfff	Memory Mapped File	Readable	Region Actions
private_0x0000000007000000	0x07000000	0x0701efff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000007030000	0x07030000	0x070affff	Private Memory	Readable, Writable	Region Actions
private_0x00000000070b0000	0x070b0000	0x074affff	Private Memory	Readable, Writable	Region Actions
private_0x00000000075b0000	0x075b0000	0x076affff	Private Memory	Readable, Writable	Region Actions
private_0x00000000076b0000	0x076b0000	0x07eaffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000007eb0000	0x07eb0000	0x082b0fff	Private Memory	Readable, Writable	Region Actions
private_0x00000000082c0000	0x082c0000	0x086c0fff	Private Memory	Readable, Writable	Region Actions
private_0x00000000086d0000	0x086d0000	0x08ad0fff	Private Memory	Readable, Writable	Region Actions
private_0x0000000008ae0000	0x08ae0000	0x08f9ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000008fa0000	0x08fa0000	0x0939ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000009400000	0x09400000	0x0941ffff	Private Memory	-	Region Actions Download Dump
private_0x0000000009530000	0x09530000	0x0962ffff	Private Memory	Readable, Writable	Region Actions
private_0x00000000099b0000	0x099b0000	0x09aaffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000009ee0000	0x09ee0000	0x09fdffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000009fe0000	0x09fe0000	0x0a0dffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000000000a130000	0x0a130000	0x0a1affff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000000000a320000	0x0a320000	0x0a39ffff	Private Memory	Readable, Writable, Executable	Region Actions Download Dump
private_0x000000000a3a0000	0x0a3a0000	0x0a4a0fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000000000a570000	0x0a570000	0x0a57ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000022580000	0x22580000	0x22c4ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000230b0000	0x230b0000	0x231affff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000231b0000	0x231b0000	0x2341ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000233a0000	0x233a0000	0x2341ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000023740000	0x23740000	0x2394ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000375f0000	0x375f0000	0x375fffff	Private Memory	Readable, Writable, Executable	Region Actions
private_0x000000006fff0000	0x6fff0000	0x6fffffff	Private Memory	Readable, Writable, Executable	Region Actions
osppc.dll	0x74d60000	0x74d92fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
user32.dll	0x775e0000	0x776d9fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
kernel32.dll	0x776e0000	0x777fefff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ntdll.dll	0x77800000	0x779a8fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
psapi.dll	0x779d0000	0x779d6fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
pagefile_0x000000007efe0000	0x7efe0000	0x7f0dffff	Pagefile Backed Memory	Readable	Region Actions
private_0x000000007f0e0000	0x7f0e0000	0x7ffdffff	Private Memory	Readable	Region Actions
private_0x000000007ffe0000	0x7ffe0000	0x7ffeffff	Private Memory	Readable	Region Actions
winword.exe	0x13f660000	0x13f83afff	Memory Mapped File	Readable, Writable, Executable	Region Actions
private_0x000007febe310000	0x7febe310000	0x7febe31ffff	Private Memory	Readable, Writable, Executable	Region Actions
chart.dll	0x7fee4420000	0x7fee4f18fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
riched20.dll	0x7fee4f20000	0x7fee5142fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
dwrite.dll	0x7fee5390000	0x7fee550dfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
d3d10warp.dll	0x7fee5510000	0x7fee56dffff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msptls.dll	0x7fee56e0000	0x7fee584ffff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msointl.dll	0x7fee5850000	0x7fee59cafff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msores.dll	0x7fee59d0000	0x7feea80efff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mso99lres.dll	0x7feea810000	0x7feeb130fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mso.dll	0x7feeb140000	0x7feec41bfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mso99lwin32client.dll	0x7feec420000	0x7feecbebfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mso40uiwin32client.dll	0x7feecbf0000	0x7feed4dafff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mso30win32client.dll	0x7feed4e0000	0x7feed957fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mso20win32client.dll	0x7feed960000	0x7feedc63fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
oart.dll	0x7feedc70000	0x7feeeddbfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
d3d11.dll	0x7feeede0000	0x7feeeea5fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
wwlib.dll	0x7feeeeb0000	0x7fef124efff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mscoreei.dll	0x7fef13f0000	0x7fef1488fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mso40uires.dll	0x7fef1490000	0x7fef1797fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mscoree.dll	0x7fef1910000	0x7fef197efff	Memory Mapped File	Readable, Writable, Executable	Region Actions
wwintl.dll	0x7fef1980000	0x7fef1a3bfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mlang.dll	0x7fef1aa0000	0x7fef1adafff	Memory Mapped File	Readable, Writable, Executable	Region Actions
npmproxy.dll	0x7fef3c70000	0x7fef3c7bfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
winspool.drv	0x7fef4210000	0x7fef4280fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msxml6.dll	0x7fef49b0000	0x7fef4ba1fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
api-ms-win-core-file-l1-2-0.dll	0x7fef5310000	0x7fef5312fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
api-ms-win-core-processthreads-l1-1-1.dll	0x7fef5320000	0x7fef5322fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
api-ms-win-core-synch-l1-2-0.dll	0x7fef5330000	0x7fef5332fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
api-ms-win-core-localization-l1-2-0.dll	0x7fef5370000	0x7fef5372fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
api-ms-win-core-file-l2-1-0.dll	0x7fef5380000	0x7fef5382fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
api-ms-win-core-timezone-l1-1-0.dll	0x7fef5550000	0x7fef5552fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ucrtbase.dll	0x7fef55a0000	0x7fef5691fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msimg32.dll	0x7fef5850000	0x7fef5856fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
c2r64.dll	0x7fef5860000	0x7fef5988fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
appvisvstream64.dll	0x7fef5990000	0x7fef5a09fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
private_0x000007ff00050000	0x7ff00050000	0x7ff0005ffff	Private Memory	-	Region Actions Download Dump
private_0x000007ff00100000	0x7ff00100000	0x7ff0010ffff	Private Memory	-	Region Actions Download Dump
private_0x000007ff00110000	0x7ff00110000	0x7ff0017ffff	Private Memory	-	Region Actions Download Dump
private_0x000007ff00180000	0x7ff00180000	0x7ff0018ffff	Private Memory	-	Region Actions Download Dump
private_0x000007ff00190000	0x7ff00190000	0x7ff0019ffff	Private Memory	-	Region Actions Download Dump
private_0x000007ffffec0000	0x7ffffec0000	0x7ffffecffff	Private Memory	Readable, Writable, Executable	Region Actions Download Dump
private_0x000007ffffed0000	0x7ffffed0000	0x7fffff5ffff	Private Memory	Readable, Writable, Executable	Region Actions Download Dump
private_0x000007fffff66000	0x7fffff66000	0x7fffff67fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffff68000	0x7fffff68000	0x7fffff69fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffff6a000	0x7fffff6a000	0x7fffff6bfff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffff6c000	0x7fffff6c000	0x7fffff6dfff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffff6e000	0x7fffff6e000	0x7fffff6ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffff70000	0x7fffff70000	0x7fffff71fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffff72000	0x7fffff72000	0x7fffff73fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffff74000	0x7fffff74000	0x7fffff75fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffff76000	0x7fffff76000	0x7fffff77fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffff78000	0x7fffff78000	0x7fffff79fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffff7a000	0x7fffff7a000	0x7fffff7bfff	Private Memory	Readable, Writable	Region Actions Download Dump
For performance reasons, the remaining 264 entries are omitted. The remaining entries can be found in flog.txt.

Created Files

Filename	File Size	Hash Values	Actions
c:\users\aetadzjz\desktop\logo.cs	1.07 KB (1098 bytes)	MD5: 667a8968a36880dc4147d2ce00c64b30 SHA1: 48233228f9babdd3bcac5b85d5ae258f91204f7e SHA256: 8aea15951d21f30f44a8d7499472b62473203959659eeb2b9059b64698deacfd	File Actions Show Properties Download
c:\users\aetadzjz\appdata\local\temp\91rxrejg.tmp	0.00 KB (0 bytes)	MD5: d41d8cd98f00b204e9800998ecf8427e SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	File Actions Show Properties
c:\users\aetadzjz\appdata\local\temp\91rxrejg.err	0.00 KB (0 bytes)	MD5: d41d8cd98f00b204e9800998ecf8427e SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	File Actions Show Properties
c:\users\aetadzjz\appdata\local\temp\91rxrejg.0.cs	1.08 KB (1101 bytes)	MD5: 3992ea6c0751d769815a98c4cffcadce SHA1: 6ba244d7eb6a6facd2b4c4e946e26987d2336e8b SHA256: b12a34c289c97db64f4267e5c67b70f4fefedfe28ae6527e7721a6ef3e4e0adc	File Actions Show Properties Download
c:\users\aetadzjz\appdata\local\temp\91rxrejg.cmdline	0.28 KB (288 bytes)	MD5: 8d42a6a6ddda3cb8546ef4cb888dbfa8 SHA1: 2024365b4311bc93867119ceee7c876683fef607 SHA256: f0d80af454b0e9060f13236c0827a4df63d61ac4964a174c999f4aa2895ff00e	File Actions Show Properties Download
c:\users\aetadzjz\appdata\local\temp\91rxrejg.out	0.37 KB (379 bytes)	MD5: 51bfb6f473aa25324ee1ed9830ca806e SHA1: f1fae130030df5b4dff15ed820ca35665886ea98 SHA256: 60a57285c3ccbfa3f03f050681e54c27de4ef1766fe6151104a919b7f7c8fa2e	File Actions Show Properties Download

Host Behavior

File (74)

Operation	Filename	Additional Information	Count	Logfile
Create	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config	desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\aETAdzjz\Desktop\Logo.cs	desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\aETAdzjz\Desktop\Logo.cs	desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.tmp	desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.0.cs	desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.cmdline	desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.out	desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.err	desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ	1	Fn
Create Directory	C:\Windows\system32\com\SOAPAssembly	-	3	Fn
Get Info	C:\Windows\system32\com\SOAPAssembly\	type = file_attributes	3	Fn
Get Info	C:\Windows\system32\com\SOAPAssembly	type = file_attributes	3	Fn
Get Info	C:\Windows\system32\com	type = file_attributes	3	Fn
Get Info	C:\Windows\system32	type = file_attributes	3	Fn
Get Info	C:\Windows	type = file_attributes	3	Fn
Get Info	C:\Users\aETAdzjz\Desktop\http100www4samyrai777m4p-host4in0t0tp4php2thread90.dll	type = file_attributes	1	Fn
Get Info	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config	type = file_attributes	2	Fn
Get Info	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config	type = file_type	2	Fn
Get Info	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config	type = size, size_out = 0	1	Fn
Get Info	C:\Program Files\Microsoft Office\root\Office16\WINWORD.config	type = file_attributes	2	Fn
Get Info	C:\Users\aETAdzjz\Desktop\Logo.cs	type = file_type	4	Fn
Get Info	C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.tmp	type = file_type	2	Fn
Get Info	C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.0.cs	type = file_type	2	Fn
Get Info	C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.cmdline	type = file_type	2	Fn
Get Info	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	type = file_attributes	1	Fn
Get Info	C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.out	type = file_type	2	Fn
Get Info	C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.err	type = file_type	2	Fn
Get Info	C:\Users\aETAdzjz\Desktop\http100www4samyrai777m4p-host4in0t0tp4php2thread90.dll	type = file_attributes	2	Fn
Open	STD_INPUT_HANDLE	-	1	Fn
Read	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config	size = 4096, size_out = 4096	6	Fn Data
Read	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config	size = 4096, size_out = 1459	1	Fn Data
Read	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config	size = 4096, size_out = 0	1	Fn
Read	C:\Users\aETAdzjz\Desktop\Logo.cs	size = 4096, size_out = 1098	1	Fn Data
Read	C:\Users\aETAdzjz\Desktop\Logo.cs	size = 950, size_out = 0	1	Fn
Read	C:\Users\aETAdzjz\Desktop\Logo.cs	size = 4096, size_out = 0	1	Fn
Write	C:\Users\aETAdzjz\Desktop\Logo.cs	size = 1098	1	Fn Data
Write	C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.0.cs	size = 1101	1	Fn Data
Write	C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.cmdline	size = 288	1	Fn Data
Write	C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.out	size = 379	1	Fn Data
Delete	C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.pdb	-	1	Fn
Delete	C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.out	-	1	Fn
Delete	C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.tmp	-	1	Fn
Delete	C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.0.cs	-	1	Fn
Delete	C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.cmdline	-	1	Fn
Delete	C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.err	-	1	Fn
Delete	C:\Users\aETAdzjz\Desktop\__Sn.cs	-	1	Fn

Registry (105)

Operation	Key	Additional Information	Count	Logfile
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\COM+ SOAP Services	-	3	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\COM+ SOAP Services	-	3	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\COM+ SOAP Services	-	3	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\COM+ SOAP Services	-	3	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\COM+ SOAP Services	-	3	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\COM+ SOAP Services	-	3	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security	-	3	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\COM+ SOAP Services	-	3	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\COM+ SOAP Services	-	3	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance	-	1	Fn
Open Key	HKEY_CURRENT_USER	-	1	Fn
Open Key	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell	-	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion	value_name = InstallationType, data = 0, type = REG_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion	value_name = InstallationType, data = Client, type = REG_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance	value_name = Library, data = 0, type = REG_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance	value_name = Library, data = netfxperf.dll, type = REG_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance	value_name = IsMultiInstance, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance	value_name = IsMultiInstance, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance	value_name = First Counter, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance	value_name = First Counter, data = 4986, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance	value_name = CategoryOptions, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance	value_name = CategoryOptions, data = 3, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance	value_name = FileMappingSize, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance	value_name = FileMappingSize, data = 131072, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance	value_name = Counter Names, type = REG_BINARY	2	Fn Data
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Enumerate Keys	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Get Key Info	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Get Key Info	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn
Get Key Info	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	-	1	Fn

Process (4)

Operation	Process	Additional Information	Success	Count	Logfile
Create	"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.cmdline"	os_pid = 0xba0, startup_flags = STARTF_USESHOWWINDOW, STARTF_USESTDHANDLES, show_window = SW_HIDE		1	Fn
Create	C:\Windows\System32\mshta.exe	show_window = SW_SHOWNORMAL		3	Fn

Module (4)

Operation	Module	Additional Information	Count	Logfile
Get Filename	-	process_name = c:\program files\microsoft office\root\office16\winword.exe, file_name_orig = C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE, size = 260	2	Fn
Create Mapping	-	filename = System Paging File, protection = PAGE_READWRITE, maximum_size = 131072	1	Fn
Map	-	process_name = c:\program files\microsoft office\root\office16\winword.exe, desired_access = FILE_MAP_WRITE	1	Fn

System (11)

Operation	Additional Information	Count	Logfile
Get Computer Name	result_out = YKYD69Q	1	Fn
Get Info	type = System Directory, result_out = C:\Windows\system32	3	Fn
Get Info	type = Operating System	7	Fn

Mutex (23)

Operation	Additional Information	Count	Logfile
Create	mutex_name = Global\.net clr networking	10	Fn
Create	mutex_name = Global\.net clr networking	1	Fn
Open	mutex_name = Global\.net clr networking, desired_access = MUTEX_MODIFY_STATE, SYNCHRONIZE	1	Fn
Release	mutex_name = Global\.net clr networking	1	Fn
Release	mutex_name = Global\.net clr networking	10	Fn

Network Behavior

DNS (1)

Operation	Additional Information	Success	Count	Logfile
Resolve Name	host = www.samyrai777m.p-host.in, address_out = 185.211.244.133		1	Fn

TCP Sessions (1)

Information	Value
Total Data Sent	0.09 KB (92 bytes)
Total Data Received	1.21 KB (1240 bytes)
Contacted Host Count	1
Contacted Hosts	185.211.244.133:80

TCP Session #1

Information	Value
Handle	0xb94
Address Family	AF_INET
Type	SOCK_STREAM
Protocol	IPPROTO_TCP
Remote Address	185.211.244.133
Remote Port	80
Local Address	0.0.0.0
Local Port	1984
Data Sent	0.09 KB (92 bytes)
Data Received	1.21 KB (1240 bytes)

Operations

Operation	Additional Information	Count	Logfile
Create	protocol = IPPROTO_TCP, address_family = AF_INET, type = SOCK_STREAM	1	Fn
Connect	remote_address = 185.211.244.133, remote_port = 80	1	Fn
Send	flags = NO_FLAG_SET, size = 92, size_out = 92	1	Fn Data
Receive	flags = NO_FLAG_SET, size = 4096, size_out = 1240	1	Fn Data

HTTP Sessions (1)

Information	Value
Total Data Sent	0.09 KB (92 bytes)
Total Data Received	1.21 KB (1240 bytes)
Contacted Host Count	1
Contacted Hosts	www.samyrai777m.p-host.in

HTTP Session #1

Information	Value
Server Name	www.samyrai777m.p-host.in
Server Port	80
Data Sent	0.09 KB (92 bytes)
Data Received	1.21 KB (1240 bytes)

Operations

Operation	Additional Information	Count	Logfile
Open Session	access_type = WINHTTP_ACCESS_TYPE_NO_PROXY, proxy_name = WINHTTP_NO_PROXY_NAME, proxy_bypass = WINHTTP_NO_PROXY_BYPASS	1	Fn
Open Connection	protocol = http, server_name = www.samyrai777m.p-host.in, server_port = 80	1	Fn
Open HTTP Request	http_verb = GET, http_version = HTTP/1.1, target_resource = /t/tp.php?thread=0	1	Fn
Send HTTP Request	headers = host: www.samyrai777m.p-host.in, connection: Keep-Alive, url = www.samyrai777m.p-host.in/t/tp.php?thread=0	1	Fn Data
Read Response	size = 4096, size_out = 1240	1	Fn Data

Process #2: csc.exe

(Host: 2, Network: 0)

Information	Value
ID	#2
File Name	c:\windows\microsoft.net\framework64\v2.0.50727\csc.exe
Command Line	"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.cmdline"
Initial Working Directory	C:\Users\aETAdzjz\Desktop\
Monitor	Start Time: 00:01:00, Reason: Child Process
Unmonitor	End Time: 00:02:36, Reason: Terminated by Timeout
Monitor Duration	00:01:36

OS Process Information

Information	Value
PID	0xba0
Parent PID	0x9b0 (c:\program files\microsoft office\root\office16\winword.exe)
Is Created or Modified Executable
Integrity Level	Medium
Username	YKYD69Q\aETAdzjz
Groups	YKYD69Q\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) BUILTIN\Administrators (USE_FOR_DENY_ONLY) BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\Logon Session 00000000:00010989 (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID) LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x BA4 0x 0

Region

Name	Start VA	End VA	Type	Permissions	Actions
private_0x0000000000010000	0x00010000	0x0002ffff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x0000000000010000	0x00010000	0x0001ffff	Pagefile Backed Memory	Readable, Writable	Region Actions
pagefile_0x0000000000020000	0x00020000	0x0002ffff	Pagefile Backed Memory	Readable, Writable	Region Actions
private_0x0000000000030000	0x00030000	0x0012ffff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x0000000000130000	0x00130000	0x00133fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000140000	0x00140000	0x00140fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000000150000	0x00150000	0x00151fff	Private Memory	Readable, Writable	Region Actions Download Dump
locale.nls	0x00160000	0x001c6fff	Memory Mapped File	Readable	Region Actions
pagefile_0x00000000001d0000	0x001d0000	0x001d0fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x00000000001e0000	0x001e0000	0x001e0fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x00000000001f0000	0x001f0000	0x001f0fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000000200000	0x00200000	0x00200fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000000210000	0x00210000	0x00210fff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x0000000000220000	0x00220000	0x00220fff	Pagefile Backed Memory	Readable, Writable	Region Actions
pagefile_0x0000000000230000	0x00230000	0x00236fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000240000	0x00240000	0x00241fff	Pagefile Backed Memory	Readable, Writable	Region Actions
pagefile_0x0000000000250000	0x00250000	0x00250fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000000260000	0x00260000	0x0035ffff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x0000000000360000	0x00360000	0x00360fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000370000	0x00370000	0x00370fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000000380000	0x00380000	0x0038ffff	Private Memory	Readable, Writable	Region Actions Download Dump
cscompui.dll	0x00390000	0x003b2fff	Memory Mapped File	Readable	Region Actions
pagefile_0x00000000003c0000	0x003c0000	0x003c0fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x00000000003d0000	0x003d0000	0x003d0fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x00000000003e0000	0x003e0000	0x003e0fff	Pagefile Backed Memory	Readable	Region Actions
csc.exe	0x00400000	0x00418fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
private_0x0000000000420000	0x00420000	0x00420fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000000430000	0x00430000	0x0052ffff	Private Memory	Readable, Writable	Region Actions Download Dump
system.runtime.remoting.dll	0x00530000	0x00579fff	Memory Mapped File	Readable	Region Actions
private_0x00000000005e0000	0x005e0000	0x005effff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x00000000005f0000	0x005f0000	0x00777fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000780000	0x00780000	0x00900fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000910000	0x00910000	0x01d0ffff	Pagefile Backed Memory	Readable	Region Actions
sortdefault.nls	0x01d10000	0x01fdefff	Memory Mapped File	Readable	Region Actions
pagefile_0x0000000001fe0000	0x01fe0000	0x023d2fff	Pagefile Backed Memory	Readable	Region Actions
private_0x00000000023e0000	0x023e0000	0x024dffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000025a0000	0x025a0000	0x025affff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000025b0000	0x025b0000	0x026affff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002700000	0x02700000	0x0277ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000027a0000	0x027a0000	0x0281ffff	Private Memory	Readable, Writable, Executable	Region Actions Download Dump
private_0x0000000002860000	0x02860000	0x028dffff	Private Memory	Readable, Writable, Executable	Region Actions Download Dump
private_0x0000000002980000	0x02980000	0x029fffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002a00000	0x02a00000	0x02dfffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002e00000	0x02e00000	0x02efffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002f10000	0x02f10000	0x02f8ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002f90000	0x02f90000	0x0318ffff	Private Memory	-	Region Actions Download Dump
system.dll	0x03190000	0x0349afff	Memory Mapped File	Readable	Region Actions
system.data.dll	0x034a0000	0x03793fff	Memory Mapped File	Readable	Region Actions
system.xml.dll	0x037a0000	0x03993fff	Memory Mapped File	Readable	Region Actions
system.web.services.dll	0x039a0000	0x03a6cfff	Memory Mapped File	Readable	Region Actions
mscorlib.dll	0x03a70000	0x03ecafff	Memory Mapped File	Readable	Region Actions
private_0x0000000003ed0000	0x03ed0000	0x03fcffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000000006fff0000	0x6fff0000	0x6fffffff	Private Memory	Readable, Writable, Executable	Region Actions Download Dump
msvcr80.dll	0x75360000	0x75428fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
user32.dll	0x775e0000	0x776d9fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
kernel32.dll	0x776e0000	0x777fefff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ntdll.dll	0x77800000	0x779a8fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
psapi.dll	0x779d0000	0x779d6fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
private_0x000000007efe0000	0x7efe0000	0x7ffdffff	Private Memory	Readable	Region Actions
pagefile_0x000000007efe0000	0x7efe0000	0x7f0dffff	Pagefile Backed Memory	Readable	Region Actions
private_0x000000007f0e0000	0x7f0e0000	0x7ffdffff	Private Memory	Readable	Region Actions
private_0x000000007ffe0000	0x7ffe0000	0x7ffeffff	Private Memory	Readable	Region Actions Download Dump
diasymreader.dll	0x516f00000	0x516fc5fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
cscomp.dll	0x538000000	0x5381e8fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
alink.dll	0x59c800000	0x59c822fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mscorwks.dll	0x7fee38d0000	0x7fee426cfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mscoreei.dll	0x7fef13f0000	0x7fef1488fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mscoree.dll	0x7fef1910000	0x7fef197efff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mscorpe.dll	0x7fef1af0000	0x7fef1b1bfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
c2r64.dll	0x7fef5860000	0x7fef5988fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
appvisvstream64.dll	0x7fef5990000	0x7fef5a09fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
appvisvsubsystems64.dll	0x7fef5a10000	0x7fef5c45fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
api-ms-win-core-synch-l1-2-0.dll	0x7fef8f20000	0x7fef8f22fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
version.dll	0x7fefc910000	0x7fefc91bfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
userenv.dll	0x7fefcaf0000	0x7fefcb0dfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rsaenh.dll	0x7fefcd40000	0x7fefcd86fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
cryptsp.dll	0x7fefd040000	0x7fefd056fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
cryptbase.dll	0x7fefd640000	0x7fefd64efff	Memory Mapped File	Readable, Writable, Executable	Region Actions
profapi.dll	0x7fefd750000	0x7fefd75efff	Memory Mapped File	Readable, Writable, Executable	Region Actions
private_0x000007fefd9c0000	0x7fefd9c0000	0x7fefd9cffff	Private Memory	Readable, Writable, Executable	Region Actions Download Dump
kernelbase.dll	0x7fefd9d0000	0x7fefda3afff	Memory Mapped File	Readable, Writable, Executable	Region Actions
imm32.dll	0x7fefdb40000	0x7fefdb6dfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msvcrt.dll	0x7fefdd50000	0x7fefddeefff	Memory Mapped File	Readable, Writable, Executable	Region Actions
oleaut32.dll	0x7fefde70000	0x7fefdf46fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
lpk.dll	0x7fefdf50000	0x7fefdf5dfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ole32.dll	0x7fefe1c0000	0x7fefe3c2fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
clbcatq.dll	0x7fefe550000	0x7fefe5e8fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rpcrt4.dll	0x7fefe640000	0x7fefe76cfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
shlwapi.dll	0x7fefe770000	0x7fefe7e0fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
shell32.dll	0x7fefe850000	0x7feff5d7fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msctf.dll	0x7feff710000	0x7feff818fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
sechost.dll	0x7feff8c0000	0x7feff8defff	Memory Mapped File	Readable, Writable, Executable	Region Actions
advapi32.dll	0x7feff8e0000	0x7feff9bafff	Memory Mapped File	Readable, Writable, Executable	Region Actions
gdi32.dll	0x7feff9d0000	0x7feffa36fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
usp10.dll	0x7feffa40000	0x7feffb08fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
apisetschema.dll	0x7feffb20000	0x7feffb20fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
pagefile_0x000007fffffb0000	0x7fffffb0000	0x7fffffd2fff	Pagefile Backed Memory	Readable	Region Actions
private_0x000007fffffd6000	0x7fffffd6000	0x7fffffd6fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffffde000	0x7fffffde000	0x7fffffdffff	Private Memory	Readable, Writable	Region Actions Download Dump

Host Behavior

COM (2)

Operation	Class	Interface	Additional Information	Success	Count	Logfile
Create	E5CB7A31-7512-11D2-89CE-0080C792E5D8	31BCFCE2-DAFB-11D2-9F81-00C04F79A0A3	cls_context = CLSCTX_INPROC_SERVER, CLSCTX_LOCAL_SERVER, CLSCTX_REMOTE_SERVER		1	Fn
Create	B81FF171-20F3-11D2-8DCC-00A0C9B00525	B81FF171-20F3-11D2-8DCC-00A0C9B00521	cls_context = CLSCTX_INPROC_SERVER, CLSCTX_LOCAL_SERVER, CLSCTX_REMOTE_SERVER		1	Fn

Process #3: cvtres.exe'

Information	Value
ID	#3
File Name	c:\windows\microsoft.net\framework64\v2.0.50727\cvtres.exe
Command Line	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\aETAdzjz\AppData\Local\Temp\RESEDB9.tmp" "c:\Users\aETAdzjz\Desktop\CSCED98.tmp"
Initial Working Directory	C:\Users\aETAdzjz\Desktop\
Monitor	Start Time: 00:01:02, Reason: Child Process
Unmonitor	End Time: 00:02:36, Reason: Terminated by Timeout
Monitor Duration	00:01:34
Remarks	No high level activity detected in monitored regions

OS Process Information

Information	Value
PID	0xbb8
Parent PID	0xba0 (c:\windows\microsoft.net\framework64\v2.0.50727\csc.exe)
Is Created or Modified Executable
Integrity Level	Medium
Username	YKYD69Q\aETAdzjz
Groups	YKYD69Q\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) BUILTIN\Administrators (USE_FOR_DENY_ONLY) BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\Logon Session 00000000:00010989 (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID) LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x BBC

Region

Name	Start VA	End VA	Type	Permissions	Actions
private_0x0000000000010000	0x00010000	0x0002ffff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x0000000000010000	0x00010000	0x0001ffff	Pagefile Backed Memory	Readable, Writable	Region Actions
pagefile_0x0000000000020000	0x00020000	0x0002ffff	Pagefile Backed Memory	Readable, Writable	Region Actions
private_0x0000000000030000	0x00030000	0x0012ffff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x0000000000130000	0x00130000	0x00133fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000140000	0x00140000	0x00140fff	Pagefile Backed Memory	Readable	Region Actions
locale.nls	0x00150000	0x001b6fff	Memory Mapped File	Readable	Region Actions
private_0x00000000001c0000	0x001c0000	0x002bffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000002f0000	0x002f0000	0x003effff	Private Memory	Readable, Writable	Region Actions Download Dump
cvtres.exe	0x00400000	0x0040cfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
private_0x0000000000410000	0x00410000	0x0050ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000000510000	0x00510000	0x0051ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000000550000	0x00550000	0x0055ffff	Private Memory	Readable, Writable	Region Actions Download Dump
msvcr80.dll	0x75360000	0x75428fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
kernel32.dll	0x776e0000	0x777fefff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ntdll.dll	0x77800000	0x779a8fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
private_0x000000007efe0000	0x7efe0000	0x7ffdffff	Private Memory	Readable	Region Actions
pagefile_0x000000007efe0000	0x7efe0000	0x7f0dffff	Pagefile Backed Memory	Readable	Region Actions
private_0x000000007f0e0000	0x7f0e0000	0x7ffdffff	Private Memory	Readable	Region Actions
private_0x000000007ffe0000	0x7ffe0000	0x7ffeffff	Private Memory	Readable	Region Actions Download Dump
kernelbase.dll	0x7fefd9d0000	0x7fefda3afff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msvcrt.dll	0x7fefdd50000	0x7fefddeefff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rpcrt4.dll	0x7fefe640000	0x7fefe76cfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
sechost.dll	0x7feff8c0000	0x7feff8defff	Memory Mapped File	Readable, Writable, Executable	Region Actions
advapi32.dll	0x7feff8e0000	0x7feff9bafff	Memory Mapped File	Readable, Writable, Executable	Region Actions
apisetschema.dll	0x7feffb20000	0x7feffb20fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
pagefile_0x000007fffffb0000	0x7fffffb0000	0x7fffffd2fff	Pagefile Backed Memory	Readable	Region Actions
private_0x000007fffffd4000	0x7fffffd4000	0x7fffffd4fff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x000007fffffde000	0x7fffffde000	0x7fffffdffff	Private Memory	Readable, Writable	Region Actions Download Dump

Process #4: mshta.exe

(Host: 590, Network: 0)

Information	Value
ID	#4
File Name	c:\windows\system32\mshta.exe
Command Line	"C:\Windows\System32\mshta.exe" http://www.samyrai777m.p-host.in/t/t.php?thread=0
Initial Working Directory	C:\Users\aETAdzjz\Desktop\
Monitor	Start Time: 00:01:02, Reason: Child Process
Unmonitor	End Time: 00:02:36, Reason: Terminated by Timeout
Monitor Duration	00:01:34

OS Process Information

Information	Value
PID	0xbc0
Parent PID	0x9b0 (c:\program files\microsoft office\root\office16\winword.exe)
Is Created or Modified Executable
Integrity Level	Medium
Username	YKYD69Q\aETAdzjz
Groups	YKYD69Q\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) BUILTIN\Administrators (USE_FOR_DENY_ONLY) BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\Logon Session 00000000:00010989 (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID) LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED) NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x BC4 0x BD8 0x BE0 0x BE4 0x BE8 0x BFC 0x 784 0x 82C 0x 84C 0x 878 0x 308 0x 6B4

Region

Name	Start VA	End VA	Type	Permissions	Actions
private_0x0000000000010000	0x00010000	0x0002ffff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x0000000000010000	0x00010000	0x0001ffff	Pagefile Backed Memory	Readable, Writable	Region Actions
pagefile_0x0000000000020000	0x00020000	0x00026fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000030000	0x00030000	0x00033fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000040000	0x00040000	0x00040fff	Pagefile Backed Memory	Readable	Region Actions
locale.nls	0x00050000	0x000b6fff	Memory Mapped File	Readable	Region Actions
imm32.dll	0x000c0000	0x000e8fff	Memory Mapped File	Readable	Region Actions
pagefile_0x00000000000c0000	0x000c0000	0x000c1fff	Pagefile Backed Memory	Readable, Writable	Region Actions
mshta.exe.mui	0x000d0000	0x000d0fff	Memory Mapped File	Readable, Writable	Region Actions
private_0x00000000000e0000	0x000e0000	0x000e0fff	Private Memory	Readable, Writable	Region Actions
private_0x00000000000f0000	0x000f0000	0x000f0fff	Private Memory	Readable, Writable	Region Actions
pagefile_0x0000000000100000	0x00100000	0x00100fff	Pagefile Backed Memory	Readable, Writable	Region Actions
private_0x0000000000110000	0x00110000	0x00110fff	Private Memory	Readable, Writable	Region Actions
rpcss.dll	0x00120000	0x0019cfff	Memory Mapped File	Readable	Region Actions
rpcss.dll	0x00120000	0x0019cfff	Memory Mapped File	Readable	Region Actions
pagefile_0x0000000000120000	0x00120000	0x00120fff	Pagefile Backed Memory	Readable, Writable	Region Actions
index.dat	0x00130000	0x0013bfff	Memory Mapped File	Readable, Writable	Region Actions
index.dat	0x00140000	0x00147fff	Memory Mapped File	Readable, Writable	Region Actions
index.dat	0x00150000	0x0015ffff	Memory Mapped File	Readable, Writable	Region Actions
index.dat	0x00160000	0x0019ffff	Memory Mapped File	Readable, Writable	Region Actions
pagefile_0x00000000001a0000	0x001a0000	0x001a0fff	Pagefile Backed Memory	Readable	Region Actions
private_0x00000000001b0000	0x001b0000	0x002affff	Private Memory	Readable, Writable	Region Actions
pagefile_0x00000000002b0000	0x002b0000	0x002b0fff	Pagefile Backed Memory	Readable	Region Actions
windowsshell.manifest	0x002c0000	0x002c0fff	Memory Mapped File	Readable	Region Actions
pagefile_0x00000000002c0000	0x002c0000	0x002c0fff	Pagefile Backed Memory	Readable, Writable	Region Actions
pagefile_0x00000000002d0000	0x002d0000	0x002d1fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x00000000002e0000	0x002e0000	0x002e1fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x00000000002f0000	0x002f0000	0x002f1fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000000300000	0x00300000	0x00300fff	Private Memory	Readable, Writable	Region Actions Download Dump
pagefile_0x0000000000300000	0x00300000	0x00300fff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000000310000	0x00310000	0x0036ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000000310000	0x00310000	0x0034ffff	Private Memory	Readable, Writable	Region Actions
oleaccrc.dll	0x00350000	0x00350fff	Memory Mapped File	Readable	Region Actions
private_0x0000000000360000	0x00360000	0x0036ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000000370000	0x00370000	0x0046ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000000470000	0x00470000	0x0056ffff	Private Memory	Readable, Writable	Region Actions
pagefile_0x0000000000570000	0x00570000	0x00570fff	Pagefile Backed Memory	Readable, Writable	Region Actions
pagefile_0x0000000000570000	0x00570000	0x00571fff	Pagefile Backed Memory	Readable	Region Actions
private_0x00000000005d0000	0x005d0000	0x005dffff	Private Memory	Readable, Writable	Region Actions
pagefile_0x00000000005e0000	0x005e0000	0x006befff	Pagefile Backed Memory	Readable	Region Actions
private_0x00000000006d0000	0x006d0000	0x006dffff	Private Memory	Readable, Writable	Region Actions
private_0x00000000006e0000	0x006e0000	0x007dffff	Private Memory	Readable, Writable	Region Actions
pagefile_0x00000000007e0000	0x007e0000	0x00967fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000970000	0x00970000	0x00af0fff	Pagefile Backed Memory	Readable	Region Actions
pagefile_0x0000000000b00000	0x00b00000	0x01efffff	Pagefile Backed Memory	Readable	Region Actions
private_0x0000000001f00000	0x01f00000	0x01ffffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000001f00000	0x01f00000	0x01f7ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000001ff0000	0x01ff0000	0x01ffffff	Private Memory	Readable, Writable	Region Actions
private_0x00000000020a0000	0x020a0000	0x0219ffff	Private Memory	Readable, Writable	Region Actions
private_0x00000000021a0000	0x021a0000	0x0238ffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x00000000021d0000	0x021d0000	0x022cffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000002310000	0x02310000	0x0238ffff	Private Memory	Readable, Writable	Region Actions
sortdefault.nls	0x02390000	0x0265efff	Memory Mapped File	Readable	Region Actions
pagefile_0x0000000002660000	0x02660000	0x029a2fff	Pagefile Backed Memory	Readable	Region Actions
private_0x00000000029b0000	0x029b0000	0x02bcffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002a20000	0x02a20000	0x02b1ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000002b50000	0x02b50000	0x02bcffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000002bd0000	0x02bd0000	0x02dcffff	Private Memory	Readable, Writable	Region Actions Download Dump
private_0x0000000002c60000	0x02c60000	0x02cdffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000002d50000	0x02d50000	0x02dcffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000002e70000	0x02e70000	0x02f6ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000002f70000	0x02f70000	0x0306ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000003080000	0x03080000	0x0317ffff	Private Memory	Readable, Writable	Region Actions
private_0x00000000031c0000	0x031c0000	0x032bffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000003300000	0x03300000	0x033fffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000003580000	0x03580000	0x0367ffff	Private Memory	Readable, Writable	Region Actions
private_0x0000000003690000	0x03690000	0x0378ffff	Private Memory	Readable, Writable	Region Actions
user32.dll	0x775e0000	0x776d9fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
kernel32.dll	0x776e0000	0x777fefff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ntdll.dll	0x77800000	0x779a8fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
normaliz.dll	0x779c0000	0x779c2fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
psapi.dll	0x779d0000	0x779d6fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
private_0x000000007efe0000	0x7efe0000	0x7ffdffff	Private Memory	Readable	Region Actions
pagefile_0x000000007efe0000	0x7efe0000	0x7f0dffff	Pagefile Backed Memory	Readable	Region Actions
private_0x000000007f0e0000	0x7f0e0000	0x7ffdffff	Private Memory	Readable	Region Actions
private_0x000000007ffe0000	0x7ffe0000	0x7ffeffff	Private Memory	Readable	Region Actions
mshta.exe	0xff9d0000	0xff9dffff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mshtml.dll	0x7fee0880000	0x7fee1117fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
oleacc.dll	0x7fef22f0000	0x7fef2343fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ieframe.dll	0x7fef2350000	0x7fef2f06fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msimtf.dll	0x7fef3140000	0x7fef314dfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rasman.dll	0x7fef3160000	0x7fef317bfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rasapi32.dll	0x7fef3180000	0x7fef31e1fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
npmproxy.dll	0x7fef3c70000	0x7fef3c7bfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rasadhlp.dll	0x7fef46d0000	0x7fef46d7fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msls31.dll	0x7fef6080000	0x7fef60bafff	Memory Mapped File	Readable, Writable, Executable	Region Actions
sensapi.dll	0x7fef6630000	0x7fef6638fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
netprofm.dll	0x7fef6660000	0x7fef66d3fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rtutils.dll	0x7fefadc0000	0x7fefadd0fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
winrnr.dll	0x7fefaf90000	0x7fefaf9afff	Memory Mapped File	Readable, Writable, Executable	Region Actions
pnrpnsp.dll	0x7fefafa0000	0x7fefafb8fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
napinsp.dll	0x7fefafc0000	0x7fefafd4fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
dwmapi.dll	0x7fefb180000	0x7fefb197fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
uxtheme.dll	0x7fefb560000	0x7fefb5b5fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
dhcpcsvc.dll	0x7fefbc30000	0x7fefbc47fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
dhcpcsvc6.dll	0x7fefbc50000	0x7fefbc60fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
fwpuclnt.dll	0x7fefbc80000	0x7fefbcd2fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
winnsi.dll	0x7fefbdd0000	0x7fefbddafff	Memory Mapped File	Readable, Writable, Executable	Region Actions
iphlpapi.dll	0x7fefbde0000	0x7fefbe06fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
nlaapi.dll	0x7fefbf70000	0x7fefbf84fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
comctl32.dll	0x7fefc060000	0x7fefc253fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ntmarta.dll	0x7fefc740000	0x7fefc76cfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
version.dll	0x7fefc910000	0x7fefc91bfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
wshtcpip.dll	0x7fefc9e0000	0x7fefc9e6fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rsaenh.dll	0x7fefcd40000	0x7fefcd86fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
dnsapi.dll	0x7fefce60000	0x7fefcebafff	Memory Mapped File	Readable, Writable, Executable	Region Actions
wship6.dll	0x7fefcfd0000	0x7fefcfd6fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
mswsock.dll	0x7fefcfe0000	0x7fefd034fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
cryptsp.dll	0x7fefd040000	0x7fefd056fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
sspicli.dll	0x7fefd610000	0x7fefd634fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
cryptbase.dll	0x7fefd640000	0x7fefd64efff	Memory Mapped File	Readable, Writable, Executable	Region Actions
sxs.dll	0x7fefd650000	0x7fefd6e0fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rpcrtremote.dll	0x7fefd730000	0x7fefd743fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
profapi.dll	0x7fefd750000	0x7fefd75efff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msasn1.dll	0x7fefd7f0000	0x7fefd7fefff	Memory Mapped File	Readable, Writable, Executable	Region Actions
crypt32.dll	0x7fefd840000	0x7fefd9a6fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
kernelbase.dll	0x7fefd9d0000	0x7fefda3afff	Memory Mapped File	Readable, Writable, Executable	Region Actions
imm32.dll	0x7fefdb40000	0x7fefdb6dfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msvcrt.dll	0x7fefdd50000	0x7fefddeefff	Memory Mapped File	Readable, Writable, Executable	Region Actions
oleaut32.dll	0x7fefde70000	0x7fefdf46fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
lpk.dll	0x7fefdf50000	0x7fefdf5dfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
iertutil.dll	0x7fefdf60000	0x7fefe1b8fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ole32.dll	0x7fefe1c0000	0x7fefe3c2fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
urlmon.dll	0x7fefe3d0000	0x7fefe547fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
clbcatq.dll	0x7fefe550000	0x7fefe5e8fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
ws2_32.dll	0x7fefe5f0000	0x7fefe63cfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
rpcrt4.dll	0x7fefe640000	0x7fefe76cfff	Memory Mapped File	Readable, Writable, Executable	Region Actions
shlwapi.dll	0x7fefe770000	0x7fefe7e0fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
wldap32.dll	0x7fefe7f0000	0x7fefe841fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
shell32.dll	0x7fefe850000	0x7feff5d7fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
wininet.dll	0x7feff5e0000	0x7feff709fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
msctf.dll	0x7feff710000	0x7feff818fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
sechost.dll	0x7feff8c0000	0x7feff8defff	Memory Mapped File	Readable, Writable, Executable	Region Actions
advapi32.dll	0x7feff8e0000	0x7feff9bafff	Memory Mapped File	Readable, Writable, Executable	Region Actions
nsi.dll	0x7feff9c0000	0x7feff9c7fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
gdi32.dll	0x7feff9d0000	0x7feffa36fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
usp10.dll	0x7feffa40000	0x7feffb08fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
apisetschema.dll	0x7feffb20000	0x7feffb20fff	Memory Mapped File	Readable, Writable, Executable	Region Actions
private_0x000007fffffa6000	0x7fffffa6000	0x7fffffa7fff	Private Memory	Readable, Writable	Region Actions
private_0x000007fffffa8000	0x7fffffa8000	0x7fffffa9fff	Private Memory	Readable, Writable	Region Actions
private_0x000007fffffaa000	0x7fffffaa000	0x7fffffabfff	Private Memory	Readable, Writable	Region Actions
private_0x000007fffffac000	0x7fffffac000	0x7fffffadfff	Private Memory	Readable, Writable	Region Actions
private_0x000007fffffae000	0x7fffffae000	0x7fffffaffff	Private Memory	Readable, Writable	Region Actions
pagefile_0x000007fffffb0000	0x7fffffb0000	0x7fffffd2fff	Pagefile Backed Memory	Readable	Region Actions
private_0x000007fffffd4000	0x7fffffd4000	0x7fffffd5fff	Private Memory	Readable, Writable	Region Actions
private_0x000007fffffd6000	0x7fffffd6000	0x7fffffd7fff	Private Memory	Readable, Writable	Region Actions
private_0x000007fffffd8000	0x7fffffd8000	0x7fffffd8fff	Private Memory	Readable, Writable	Region Actions
private_0x000007fffffda000	0x7fffffda000	0x7fffffdbfff	Private Memory	Readable, Writable	Region Actions
private_0x000007fffffdc000	0x7fffffdc000	0x7fffffddfff	Private Memory	Readable, Writable	Region Actions
private_0x000007fffffde000	0x7fffffde000	0x7fffffdffff	Private Memory	Readable, Writable	Region Actions
For performance reasons, the remaining 23 entries are omitted. The remaining entries can be found in flog.txt.

Modified Files

Filename	File Size	Hash Values	YARA Match	Actions
c:\users\aetadzjz\appdata\local\microsoft\windows\temporary internet files\content.ie5\x9ohk109\t[2].hta	3.24 KB (3313 bytes)	MD5: 13b131d98fea2526196b20496ec68b0a SHA1: 1284d7400f30f5a2c409f3f53fcf34b30c32268d SHA256: ae09b5dc38c85387a861cb4aee8b08ef6c7b216f21ba1bd06c9d1b3adab46a75		File Actions Show Properties Download

Host Behavior

COM (5)

Operation	Class	Interface	Additional Information	Count	Logfile
Create	3050F5C8-98B5-11CF-BB82-00AA00BDCE0B	00000000-0000-0000-C000-000000000046	cls_context = CLSCTX_INPROC_SERVER	1	Fn
Create	50D5107A-D278-4871-8989-F4CEAAF59CFC	08C0E040-62D1-11D1-9326-0060B067B86E	cls_context = CLSCTX_INPROC_SERVER, CLSCTX_NO_CODE_DOWNLOAD	1	Fn
Create	B54F3741-5B07-11CF-A4B0-00AA004A55E8	BB1A2AE1-A4F9-11CF-8F20-00805F2CD064	cls_context = CLSCTX_INPROC_SERVER	1	Fn
Create	6C736DB1-BD94-11D0-8A23-00AA00B58E10	6C736DC1-AB0D-11D0-A2AD-00A0C90F27E8	cls_context = CLSCTX_INPROC_SERVER	1	Fn
Create	WsCriPt.SHeLl	IClassFactory	cls_context = CLSCTX_INPROC_SERVER, CLSCTX_LOCAL_SERVER, CLSCTX_REMOTE_SERVER	1	Fn

File (4)

Operation	Filename	Additional Information	Count	Logfile
Open	STD_INPUT_HANDLE	-	1	Fn
Open	STD_OUTPUT_HANDLE	-	1	Fn
Open	STD_ERROR_HANDLE	-	1	Fn
Open Mapping	#MSHTML#PERF#00000BC0	desired_access = FILE_MAP_WRITE	1	Fn

Registry (99)

Operation	Key	Additional Information	Count	Logfile
Open Key	HKEY_CLASSES_ROOT\clsid\{25336920-03f9-11cf-8fd0-00aa00686f13}\InProcServer32	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	6	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	8	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CSS_DATA_RESPECTS_XSS_ZONE_SETTING_KB912120	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CSS_DATA_RESPECTS_XSS_ZONE_SETTING_KB912120	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	8	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	6	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_EXTERNAL_STYLE_SHEET_FIX_FOR_SMARTNAVIGATION_KB926131	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_EXTERNAL_STYLE_SHEET_FIX_FOR_SMARTNAVIGATION_KB926131	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ARIA_SUPPORT	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ARIA_SUPPORT	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LEGACY_DISPPARAMS	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LEGACY_DISPPARAMS	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PRIVATE_FONT_SETTING	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PRIVATE_FONT_SETTING	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CSS_SHOW_HIDE_EVENTS	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CSS_SHOW_HIDE_EVENTS	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISPLAY_NODE_ADVISE_KB833311	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISPLAY_NODE_ADVISE_KB833311	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALLOW_EXPANDURI_BYPASS	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALLOW_EXPANDURI_BYPASS	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BODY_SIZE_IN_EDITABLE_IFRAME_KB943245	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BODY_SIZE_IN_EDITABLE_IFRAME_KB943245	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DATABINDING_SUPPORT	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DATABINDING_SUPPORT	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENFORCE_BSTR	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENFORCE_BSTR	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_DYNAMIC_OBJECT_CACHING	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_DYNAMIC_OBJECT_CACHING	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LEGACY_TOSTRING_IN_COMPATVIEW	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LEGACY_TOSTRING_IN_COMPATVIEW	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_OM_SCREEN_ORIGIN_DISPLAY_PIXELS	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_OM_SCREEN_ORIGIN_DISPLAY_PIXELS	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_CRASH_RECOVERY_SAVE_KB978454	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_CRASH_RECOVERY_SAVE_KB978454	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CLEANUP_AT_FLS	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CLEANUP_AT_FLS	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MANAGE_SCRIPT_CIRCULAR_REFS	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MANAGE_SCRIPT_CIRCULAR_REFS	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DOCUMENT_COMPATIBLE_MODE	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DOCUMENT_COMPATIBLE_MODE	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_DOCUMENT_ZOOM	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_DOCUMENT_ZOOM	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PageSetup	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_XSSFILTER	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_XSSFILTER	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SHOW_FAILED_CONNECT_CONTENT_KB942615	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SHOW_FAILED_CONNECT_CONTENT_KB942615	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MSHTML_AUTOLOAD_IEFRAME	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MSHTML_AUTOLOAD_IEFRAME	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_TREAT_IMAGE_AS_AUTHORITATIVE	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_TREAT_IMAGE_AS_AUTHORITATIVE	-	1	Fn
Read Value	HKEY_CLASSES_ROOT\clsid\{25336920-03f9-11cf-8fd0-00aa00686f13}\InProcServer32	data = C:\Windows\System32\mshtml.dll, type = REG_SZ	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	value_name = NoFileMenu, type = REG_NONE	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PageSetup	value_name = Print_Background	1	Fn

Process (1)

Operation	Process	Additional Information	Success	Count	Logfile
Create	C:\Windows\SYSteM32\windowspOweRSHeLL\V1.0\PoWErSHELL.Exe	show_window = SW_HIDE		1	Fn

Module (52)

Operation	Module	Additional Information	Count	Logfile
Load	C:\Windows\System32\mshtml.dll	base_address = 0x7fee0880000	1	Fn
Load	comctl32.dll	base_address = 0x7fefc060000	1	Fn
Load	OLEAUT32.dll	base_address = 0x7fefde70000	1	Fn
Load	mshtml.dll	base_address = 0x7fee0880000	1	Fn
Load	OLEACC.DLL	base_address = 0x7fef22f0000	1	Fn
Load	ieframe.dll	base_address = 0x7fef2350000	2	Fn
Load	ole32.dll	base_address = 0x7fefe1c0000	1	Fn
Load	shell32.dll	base_address = 0x7fefe850000	1	Fn
Load	oleaut32.dll	base_address = 0x7fefde70000	1	Fn
Load	WININET.dll	base_address = 0x7feff5e0000	1	Fn
Get Handle	c:\windows\system32\mshta.exe	base_address = 0xff9d0000	2	Fn
Get Handle	c:\windows\system32\kernel32.dll	base_address = 0x776e0000	3	Fn
Get Handle	c:\windows\system32\advapi32.dll	base_address = 0x7feff8e0000	1	Fn
Get Handle	EXPLORER.EXE	base_address = 0x0	1	Fn
Get Handle	IEXPLORE.EXE	base_address = 0x0	1	Fn
Get Handle	c:\windows\system32\ole32.dll	base_address = 0x7fefe1c0000	1	Fn
Get Handle	mscoree.dll	base_address = 0x0	1	Fn
Get Filename	-	process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Windows\System32\mshta.exe, size = 260	4	Fn
Get Filename	C:\Windows\System32\mshtml.dll	process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Windows\System32\mshtml.dll, size = 260	1	Fn
Get Filename	c:\windows\system32\mshta.exe	process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Windows\System32\mshta.exe, size = 260	1	Fn
Get Filename	IEXPLORE.EXE	process_name = c:\windows\system32\mshta.exe, file_name_orig = C:\Windows\System32\mshta.exe, size = 261	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = HeapSetInformation, address_out = 0x776fc4a0	1	Fn
Get Address	c:\windows\system32\advapi32.dll	function = EventWrite, address_out = 0x7782b510	1	Fn
Get Address	c:\windows\system32\advapi32.dll	function = EventRegister, address_out = 0x7783cac0	1	Fn
Get Address	c:\windows\system32\advapi32.dll	function = EventUnregister, address_out = 0x77823c80	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = RegisterApplicationRestart, address_out = 0x7775f510	1	Fn
Get Address	c:\windows\system32\mshtml.dll	function = RunHTMLApplication, address_out = 0x7fee0ad5b90	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = InitializeSRWLock, address_out = 0x778384f0	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = AcquireSRWLockExclusive, address_out = 0x77828020	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = AcquireSRWLockShared, address_out = 0x778254e0	1