Analysis
- max time kernel
150s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
08/04/2024, 01:23
General
- Target 45503927f90fe4aeae2c91c6f13d3a647338f44565cc2ca26ba0c1d49968c9bf.exe
- Size 3.8MB
- Sample240408-br6v9ace61
- SHA256 45503927f90fe4aeae2c91c6f13d3a647338f44565cc2ca26ba0c1d49968c9bf
Malware Config
Extracted
-
xenorat
-
dgorijan20785.hopto.org
-
Xens_nd8918d
-
delay
5000
-
install_path
appdata
-
port
4488
-
startup_name
rar
Extracted
-
asyncrat
-
0.5.6A
-
dgorijan20785.hopto.org:6606
-
dgorijan20785.hopto.org:7707
-
dgorijan20785.hopto.org:8808
-
45.74.4.244:6606
-
45.74.4.244:7707
-
45.74.4.244:8808
-
v5tvc4rc3ex7
-
delay
5
-
install
false
-
install_folder
%AppData%
Extracted
-
darkcomet
-
2024+Apre2-new
-
dgorijan20785.hopto.org:35800
-
DC_MUTEX-3MW33TC
-
gencode
XE9EWd209YcQ
-
install
false
-
offline_keylogger
true
-
password
hhhhhh
-
persistence
false
Extracted
-
darkcomet
- gencode
-
install
false
-
offline_keylogger
false
-
persistence
false
Extracted
-
darkcomet
-
New-July-July4-02
-
dgorijan20785.hopto.org:35800
-
DC_MUTEX-JFYU2BC
-
gencode
UkVkDi2EZxxn
-
install
false
-
offline_keylogger
true
-
password
hhhhhh
-
persistence
false
Extracted
-
warzonerat
-
45.74.4.244:5199
-
dgorijan20785.hopto.org:5199
Extracted
-
darkcomet
-
New-July-July4-0
-
45.74.4.244:35800
-
DC_MUTEX-RT27KF0
-
gencode
cKUHbX2GsGhs
-
install
false
-
offline_keylogger
true
-
password
hhhhhh
-
persistence
false
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Babylon RAT
Babylon RAT is remote access trojan written in C++.
- Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
- WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
- XenorRat
XenorRat is a remote access trojan written in C#.
- Async RAT payload 1 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 6 IoCs
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 11 IoCs
- Detects executables embedding command execution via IExecuteCommand COM object 6 IoCs
- Detects file containing reversed ASEP Autorun registry keys 3 IoCs
- UPX dump on OEP (original entry point) 21 IoCs
- Warzone RAT payload 6 IoCs
- Drops file in Drivers directory 4 IoCs
- Checks computer location settings 2 TTPs 19 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 2 IoCs
- Executes dropped EXE 48 IoCs
- UPX packed file 21 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 10 IoCs
- Suspicious use of SetThreadContext 15 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 1 IoCs
- NTFS ADS 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\45503927f90fe4aeae2c91c6f13d3a647338f44565cc2ca26ba0c1d49968c9bf.exe"C:\Users\Admin\AppData\Local\Temp\45503927f90fe4aeae2c91c6f13d3a647338f44565cc2ca26ba0c1d49968c9bf.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\sms731D.tmp"C:\Users\Admin\AppData\Local\Temp\sms731D.tmp"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\drvmonit.exe"C:\Users\Admin\AppData\Local\Temp\drvmonit.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\XenoManager\drvmonit.exe"C:\Users\Admin\AppData\Roaming\XenoManager\drvmonit.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "rar" /XML "C:\Users\Admin\AppData\Local\Temp\tmp96C2.tmp" /F5⤵
- Creates scheduled task(s)
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\logons.exe"C:\Users\Admin\AppData\Local\Temp\logons.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\sms7A21.tmp"C:\Users\Admin\AppData\Local\Temp\sms7A21.tmp"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\rarwin.exe"C:\Users\Admin\AppData\Local\Temp\rarwin.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe4⤵
- Drops file in Drivers directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE"C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE"5⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==6⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe6⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE"C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE"5⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==6⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXEC:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE6⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE"C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE"5⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==6⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXEC:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE"C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==6⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXEC:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXEC:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXEC:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXEC:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE"C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE"5⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==6⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXEC:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE"C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==6⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXEC:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE6⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'wintskl"' /tr "'C:\Users\Admin\AppData\Roaming\wintskl.exe"'7⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpC61A.tmp.bat""7⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 38⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\wintskl.exe"C:\Users\Admin\AppData\Roaming\wintskl.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==9⤵
-
-
C:\Users\Admin\AppData\Roaming\wintskl.exeC:\Users\Admin\AppData\Roaming\wintskl.exe9⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE"C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE"5⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==6⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe6⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe6⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE"C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE"5⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==6⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXEC:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXEC:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXEC:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE6⤵
- Drops file in Drivers directory
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE"C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE"5⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXEC:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE6⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE"C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXEC:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXEC:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE6⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- NTFS ADS
-
C:\Users\Admin\Documents\wintsklt.exe"C:\Users\Admin\Documents\wintsklt.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==8⤵
-
-
C:\Users\Admin\Documents\wintsklt.exeC:\Users\Admin\Documents\wintsklt.exe8⤵
- Executes dropped EXE
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE"C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE"5⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXEC:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE6⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE"C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXEC:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXEC:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXEC:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE6⤵
- Executes dropped EXE
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\svlhost.exe"C:\Users\Admin\AppData\Local\Temp\svlhost.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\sms8472.tmp"C:\Users\Admin\AppData\Local\Temp\sms8472.tmp"4⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\usbserv.exe"C:\Users\Admin\AppData\Local\Temp\usbserv.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\XenoManager\usbserv.exe"C:\Users\Admin\AppData\Roaming\XenoManager\usbserv.exe"4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\winlists.exe"C:\Users\Admin\AppData\Local\Temp\winlists.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\sms85F9.tmp"C:\Users\Admin\AppData\Local\Temp\sms85F9.tmp"4⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\wintskl.exe"C:\Users\Admin\AppData\Local\Temp\wintskl.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\sms804C.tmp"C:\Users\Admin\AppData\Local\Temp\sms804C.tmp"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
AUDIOPT.EXE.log
powershell.exe.log
usbserv.exe.log
ModuleAnalysisCache
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
ADOBESERV.EXE
AUDIOPT.EXE
DRVVIDEO.EXE
WINCPUL.EXE
WINLOGONL.EXE
WINPLAY.EXE
__PSScriptPolicyTest_cngje0h0.vkp.ps1
drvmonit.exe
logons.exe
rarwin.exe
sms731D.tmp
sms7A21.tmp
sms804C.tmp
sms8472.tmp
sms85F9.tmp
svlhost.exe
tmp96C2.tmp
usbserv.exe
winlists.exe
wintskl.exe
hosts
memory/544-66-0x00000000004D0000-0x00000000004E2000-memory.dmp
memory/544-196-0x000000001B040000-0x000000001B050000-memory.dmp
memory/544-101-0x00007FFCB9B80000-0x00007FFCBA641000-memory.dmp
memory/544-173-0x00007FFCB9B80000-0x00007FFCBA641000-memory.dmp
memory/544-165-0x000000001B040000-0x000000001B050000-memory.dmp
memory/916-163-0x0000000006590000-0x00000000065AE000-memory.dmp
memory/916-164-0x0000000006630000-0x000000000667C000-memory.dmp
memory/916-182-0x0000000073BA0000-0x0000000074350000-memory.dmp
memory/916-187-0x0000000073BA0000-0x0000000074350000-memory.dmp
memory/916-145-0x0000000002FA0000-0x0000000002FD6000-memory.dmp
memory/916-146-0x0000000073BA0000-0x0000000074350000-memory.dmp
memory/916-148-0x0000000005860000-0x0000000005E88000-memory.dmp
memory/916-147-0x0000000005220000-0x0000000005230000-memory.dmp
memory/916-149-0x0000000005220000-0x0000000005230000-memory.dmp
memory/916-150-0x00000000057B0000-0x00000000057D2000-memory.dmp
memory/916-156-0x0000000005E90000-0x0000000005EF6000-memory.dmp
memory/916-161-0x0000000005F70000-0x0000000005FD6000-memory.dmp
memory/916-169-0x0000000006A80000-0x0000000006A9A000-memory.dmp
memory/916-162-0x00000000060E0000-0x0000000006434000-memory.dmp
memory/916-168-0x0000000007E00000-0x000000000847A000-memory.dmp
memory/916-184-0x0000000005220000-0x0000000005230000-memory.dmp
memory/916-167-0x0000000005220000-0x0000000005230000-memory.dmp
memory/1340-195-0x0000000000400000-0x0000000000853000-memory.dmp
memory/1340-305-0x0000000000400000-0x0000000000853000-memory.dmp
memory/1340-300-0x0000000000400000-0x0000000000853000-memory.dmp
memory/1340-197-0x00000000030B0000-0x00000000030B1000-memory.dmp
memory/1340-194-0x0000000000400000-0x0000000000853000-memory.dmp
memory/1340-193-0x0000000000400000-0x0000000000853000-memory.dmp
memory/1340-189-0x0000000000400000-0x0000000000853000-memory.dmp
memory/1340-298-0x0000000000400000-0x0000000000853000-memory.dmp
memory/1488-629-0x0000000001030000-0x0000000001031000-memory.dmp
memory/2408-244-0x0000000073BA0000-0x0000000074350000-memory.dmp
memory/2408-266-0x00000000004E0000-0x0000000000566000-memory.dmp
memory/2568-243-0x0000000000D10000-0x0000000000DC8000-memory.dmp
memory/3116-144-0x0000000074F40000-0x0000000074F79000-memory.dmp
memory/3408-180-0x00000000055F0000-0x0000000005600000-memory.dmp
memory/3408-111-0x0000000000BD0000-0x0000000000BE2000-memory.dmp
memory/3408-178-0x0000000073BA0000-0x0000000074350000-memory.dmp
memory/3408-131-0x00000000055F0000-0x0000000005600000-memory.dmp
memory/3408-122-0x0000000073BA0000-0x0000000074350000-memory.dmp
memory/3816-647-0x00000000014D0000-0x00000000014D1000-memory.dmp
memory/4052-92-0x0000000004FD0000-0x0000000005062000-memory.dmp
memory/4052-137-0x0000000006600000-0x00000000067EC000-memory.dmp
memory/4052-172-0x0000000004E00000-0x0000000004E10000-memory.dmp
memory/4052-84-0x0000000073BA0000-0x0000000074350000-memory.dmp
memory/4052-88-0x0000000004E00000-0x0000000004E10000-memory.dmp
memory/4052-83-0x0000000000C60000-0x0000000000C66000-memory.dmp
memory/4052-91-0x00000000054E0000-0x0000000005A84000-memory.dmp
memory/4052-192-0x0000000073BA0000-0x0000000074350000-memory.dmp
memory/4052-103-0x0000000004F70000-0x0000000004F7A000-memory.dmp
memory/4052-58-0x00000000001E0000-0x00000000003F8000-memory.dmp
memory/4052-166-0x0000000073BA0000-0x0000000074350000-memory.dmp
memory/4052-141-0x00000000067F0000-0x000000000683C000-memory.dmp
memory/4336-135-0x0000000073BA0000-0x0000000074350000-memory.dmp
memory/4412-269-0x0000000000140000-0x00000000001C8000-memory.dmp
memory/4412-270-0x0000000073BA0000-0x0000000074350000-memory.dmp
memory/4864-256-0x0000000005120000-0x0000000005126000-memory.dmp
memory/4864-242-0x0000000000970000-0x0000000000A6A000-memory.dmp
memory/4864-230-0x0000000073BA0000-0x0000000074350000-memory.dmp
memory/4888-176-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/4888-143-0x00000000022C0000-0x00000000022C1000-memory.dmp
memory/5044-177-0x0000000073BA0000-0x0000000074350000-memory.dmp
memory/5044-179-0x0000000005630000-0x0000000005640000-memory.dmp
memory/5044-113-0x0000000073BA0000-0x0000000074350000-memory.dmp
memory/5044-124-0x0000000005630000-0x0000000005640000-memory.dmp
memory/5064-80-0x00000000007F0000-0x0000000000828000-memory.dmp
memory/5064-87-0x0000000073BA0000-0x0000000074350000-memory.dmp
memory/5064-134-0x0000000073BA0000-0x0000000074350000-memory.dmp
memory/5064-85-0x0000000002960000-0x0000000002966000-memory.dmp
memory/5064-90-0x0000000005190000-0x00000000051A0000-memory.dmp
memory/5072-56-0x0000000073BA0000-0x0000000074350000-memory.dmp
memory/5072-43-0x0000000000E20000-0x0000000000E4C000-memory.dmp
memory/5072-116-0x0000000073BA0000-0x0000000074350000-memory.dmp
memory/6432-615-0x0000000000BF0000-0x0000000000BF1000-memory.dmp
memory/6740-485-0x0000000000400000-0x00000000004C9000-memory.dmp
memory/6740-494-0x0000000000400000-0x00000000004C9000-memory.dmp
memory/6740-483-0x0000000000400000-0x00000000004C9000-memory.dmp
memory/6740-481-0x0000000000400000-0x00000000004C9000-memory.dmp
memory/6740-480-0x0000000000400000-0x00000000004C9000-memory.dmp
memory/6740-477-0x0000000000400000-0x00000000004C9000-memory.dmp
memory/6740-597-0x0000000000400000-0x00000000004C9000-memory.dmp
memory/6740-593-0x0000000000400000-0x00000000004C9000-memory.dmp
memory/6960-521-0x0000000000400000-0x0000000000554000-memory.dmp
memory/6960-513-0x0000000000400000-0x0000000000554000-memory.dmp
memory/6972-544-0x0000000000400000-0x0000000000412000-memory.dmp
memory/7064-528-0x0000000000400000-0x0000000000559000-memory.dmp
memory/7064-557-0x0000000000400000-0x0000000000559000-memory.dmp
memory/7084-547-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/7084-542-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/7084-567-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/7084-570-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/7084-535-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/7084-530-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/7100-562-0x0000000000400000-0x0000000000559000-memory.dmp
memory/7100-549-0x0000000000400000-0x0000000000559000-memory.dmp