Analysis
- max time kernel
149s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
17/10/2026, 18:12
General
- Target 2026-10-16_4a7b86057e3778708cfae100a6dbc2ad_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 1.7MB
- Sample261017-wtaaaatz3n
- SHA256 1ea735969d9cbd4dbf7634fc27574bfb3b0b300c2cc25a3331c77a5253e603e2
Malware Config
Signatures
- Family: DcRat 40 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
- Process spawned unexpected child process 38 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- UAC bypass 3 TTPs 3 IoCs
- Detects executables packed with SmartAssembly 5 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 4 IoCs
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
- SmartAssembly .NET packer 5 IoCs
Detects SmartAssembly .NET packer.
- Drops file in Program Files directory 5 IoCs
- Drops file in Windows directory 5 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 38 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 49 IoCs
- Suspicious use of AdjustPrivilegeToken 14 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- System policy modification 1 TTPs 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-16_4a7b86057e3778708cfae100a6dbc2ad_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-16_4a7b86057e3778708cfae100a6dbc2ad_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- Family: DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wBFOC1T0IQ.bat"2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:24⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\2026-10-16_4a7b86057e3778708cfae100a6dbc2ad_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-16_4a7b86057e3778708cfae100a6dbc2ad_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"3⤵
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\Windows\addins\SearchApp.exe'" /f1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\addins\SearchApp.exe'" /rl HIGHEST /f1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\Windows\addins\SearchApp.exe'" /rl HIGHEST /f1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 9 /tr "'C:\Program Files\edge_BITS_4440_1702489812\WaaSMedicAgent.exe'" /f1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Program Files\edge_BITS_4440_1702489812\WaaSMedicAgent.exe'" /rl HIGHEST /f1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 11 /tr "'C:\Program Files\edge_BITS_4440_1702489812\WaaSMedicAgent.exe'" /rl HIGHEST /f1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\addins\SearchApp.exe"C:\Windows\addins\SearchApp.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\edge_BITS_4440_1702489812\WaaSMedicAgent.exe"C:\Program Files\edge_BITS_4440_1702489812\WaaSMedicAgent.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\327d8213-67b6-442a-a1da-165f194c1b9b.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Program Files\edge_BITS_4440_1702489812\WaaSMedicAgent.exe"C:\Program Files\edge_BITS_4440_1702489812\WaaSMedicAgent.exe"3⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\00d5941b-ef00-4ad5-b52b-bf07e6d0f6c0.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Program Files\edge_BITS_4148_1663284155\taskhostw.exe'" /f1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\edge_BITS_4148_1663284155\taskhostw.exe'" /rl HIGHEST /f1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\Program Files\edge_BITS_4148_1663284155\taskhostw.exe'" /rl HIGHEST /f1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Program Files\edge_BITS_4332_1025103648\SearchApp.exe'" /f1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files\edge_BITS_4332_1025103648\SearchApp.exe'" /rl HIGHEST /f1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Program Files\edge_BITS_4332_1025103648\SearchApp.exe'" /rl HIGHEST /f1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershellp" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\powershell.exe'" /f1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\powershell.exe'" /rl HIGHEST /f1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershellp" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\powershell.exe'" /rl HIGHEST /f1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Windows\Web\Wallpaper\conhost.exe'" /f1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\Web\Wallpaper\conhost.exe'" /rl HIGHEST /f1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Windows\Web\Wallpaper\conhost.exe'" /rl HIGHEST /f1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Program Files\edge_BITS_4480_652632329\explorer.exe'" /f1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\edge_BITS_4480_652632329\explorer.exe'" /rl HIGHEST /f1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Program Files\edge_BITS_4480_652632329\explorer.exe'" /rl HIGHEST /f1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows NT\conhost.exe'" /f1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\conhost.exe'" /rl HIGHEST /f1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows NT\conhost.exe'" /rl HIGHEST /f1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Favorites\TrustedInstaller.exe'" /f1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TrustedInstaller" /sc ONLOGON /tr "'C:\Users\Default\Favorites\TrustedInstaller.exe'" /rl HIGHEST /f1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Favorites\TrustedInstaller.exe'" /rl HIGHEST /f1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershellp" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\powershell.exe'" /f1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Program Files\edge_BITS_4148_1663284155\taskhostw.exe"C:\Program Files\edge_BITS_4148_1663284155\taskhostw.exe"1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Users\Admin\powershell.exe'" /rl HIGHEST /f1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Program Files\edge_BITS_4332_1025103648\SearchApp.exe"C:\Program Files\edge_BITS_4332_1025103648\SearchApp.exe"1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershellp" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\powershell.exe'" /rl HIGHEST /f1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe'" /f1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Program Files (x86)\Windows Multimedia Platform\powershell.exe"C:\Program Files (x86)\Windows Multimedia Platform\powershell.exe"1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\Web\Wallpaper\conhost.exe"C:\Windows\Web\Wallpaper\conhost.exe"1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershellp" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\powershell.exe'" /f1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Users\All Users\powershell.exe'" /rl HIGHEST /f1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershellp" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\powershell.exe'" /rl HIGHEST /f1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft.NET\RuntimeBroker.exe'" /f1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
WaaSMedicAgent.exe
2026-10-16_4a7b86057e3778708cfae100a6dbc2ad_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe.log
SearchApp.exe.log
WaaSMedicAgent.exe.log
powershell.exe.log
ModuleAnalysisCache
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
00d5941b-ef00-4ad5-b52b-bf07e6d0f6c0.vbs
327d8213-67b6-442a-a1da-165f194c1b9b.vbs
RCX3F23.tmp
__PSScriptPolicyTest_44xu1z24.oah.ps1
wBFOC1T0IQ.bat
conhost.exe
memory/468-15855-0x0000000070500000-0x000000007054C000-memory.dmp
memory/468-9143-0x0000000005450000-0x00000000054B6000-memory.dmp
memory/468-9142-0x0000000004C40000-0x0000000004C62000-memory.dmp
memory/468-9341-0x0000000005530000-0x0000000005884000-memory.dmp
memory/872-15908-0x00000000073D0000-0x00000000073E1000-memory.dmp
memory/872-15828-0x0000000070500000-0x000000007054C000-memory.dmp
memory/872-16494-0x0000000007500000-0x000000000751A000-memory.dmp
memory/876-15817-0x0000000006F40000-0x0000000006FE3000-memory.dmp
memory/876-15605-0x0000000005970000-0x000000000598E000-memory.dmp
memory/876-15728-0x0000000005E00000-0x0000000005E4C000-memory.dmp
memory/876-15807-0x0000000006EF0000-0x0000000006F22000-memory.dmp
memory/876-15808-0x0000000070500000-0x000000007054C000-memory.dmp
memory/876-15816-0x0000000006ED0000-0x0000000006EEE000-memory.dmp
memory/1772-15818-0x0000000070500000-0x000000007054C000-memory.dmp
memory/1864-82-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-5244-0x00000000068F0000-0x00000000068FC000-memory.dmp
memory/1864-86-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-84-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-0-0x0000000005010000-0x0000000005020000-memory.dmp
memory/1864-78-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-76-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-72-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-70-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-68-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-66-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-62-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-60-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-58-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-56-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-54-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-64-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-52-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-50-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-46-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-44-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-40-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-38-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-30-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-28-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-26-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-24-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-22-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-48-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-42-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-36-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-20-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-19-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-16-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-14-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-8-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-7-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-5-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-1907-0x0000000005010000-0x0000000005020000-memory.dmp
memory/1864-2114-0x0000000005010000-0x0000000005020000-memory.dmp
memory/1864-2500-0x0000000005010000-0x0000000005020000-memory.dmp
memory/1864-5228-0x0000000005010000-0x0000000005020000-memory.dmp
memory/1864-5229-0x0000000002AA0000-0x0000000002ABC000-memory.dmp
memory/1864-5230-0x0000000002AD0000-0x0000000002B20000-memory.dmp
memory/1864-5232-0x0000000006220000-0x0000000006230000-memory.dmp
memory/1864-5231-0x0000000002B30000-0x0000000002B38000-memory.dmp
memory/1864-5235-0x0000000006300000-0x0000000006310000-memory.dmp
memory/1864-5234-0x0000000006260000-0x0000000006268000-memory.dmp
memory/1864-5233-0x00000000062E0000-0x00000000062F6000-memory.dmp
memory/1864-5236-0x0000000006720000-0x000000000672A000-memory.dmp
memory/1864-5237-0x0000000006750000-0x000000000675C000-memory.dmp
memory/1864-5238-0x0000000006760000-0x0000000006772000-memory.dmp
memory/1864-5239-0x0000000007A90000-0x0000000007FBC000-memory.dmp
memory/1864-5240-0x00000000067F0000-0x00000000067FC000-memory.dmp
memory/1864-5241-0x0000000006800000-0x000000000680C000-memory.dmp
memory/1864-88-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-5243-0x0000000006850000-0x0000000006858000-memory.dmp
memory/1864-5245-0x00000000082C0000-0x0000000008352000-memory.dmp
memory/1864-5246-0x0000000006920000-0x000000000692C000-memory.dmp
memory/1864-5242-0x0000000006830000-0x000000000683A000-memory.dmp
memory/1864-5249-0x0000000005010000-0x0000000005020000-memory.dmp
memory/1864-5250-0x00000000084B0000-0x0000000008516000-memory.dmp
memory/1864-90-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-92-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-1-0x00000000052A0000-0x000000000551C000-memory.dmp
memory/1864-2-0x0000000005010000-0x0000000005020000-memory.dmp
memory/1864-7882-0x0000000005010000-0x0000000005020000-memory.dmp
memory/1864-94-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-96-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-98-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-100-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-102-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-106-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-108-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-110-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-112-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-114-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-3-0x0000000005520000-0x0000000005AC4000-memory.dmp
memory/1864-116-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-118-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-120-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-4-0x0000000005AD0000-0x0000000005D4A000-memory.dmp
memory/1864-122-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-124-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-12-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-10-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-32-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-34-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-74-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-80-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-126-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-104-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-130-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/1864-128-0x0000000005AD0000-0x0000000005D44000-memory.dmp
memory/2032-15906-0x00000000076F0000-0x00000000076FA000-memory.dmp
memory/2032-15912-0x00000000078D0000-0x00000000078DE000-memory.dmp
memory/2032-16144-0x00000000078E0000-0x00000000078F4000-memory.dmp
memory/2032-15836-0x0000000070500000-0x000000007054C000-memory.dmp
memory/2032-15880-0x0000000007680000-0x000000000769A000-memory.dmp
memory/2032-15879-0x0000000007CC0000-0x000000000833A000-memory.dmp
memory/2652-15898-0x0000000070500000-0x000000007054C000-memory.dmp
memory/2652-6695-0x00000000031A0000-0x00000000031D6000-memory.dmp
memory/2664-15863-0x0000000070500000-0x000000007054C000-memory.dmp
memory/2992-15869-0x0000000070500000-0x000000007054C000-memory.dmp
memory/3140-15890-0x0000000070500000-0x000000007054C000-memory.dmp
memory/4356-15881-0x0000000070500000-0x000000007054C000-memory.dmp
memory/5392-15846-0x0000000070500000-0x000000007054C000-memory.dmp
memory/5392-15907-0x0000000007580000-0x0000000007616000-memory.dmp
memory/5392-16828-0x0000000007640000-0x0000000007648000-memory.dmp
memory/5392-6697-0x00000000051C0000-0x00000000057E8000-memory.dmp