dcrat | 93f21391880b070015bb1e3febff4a86b978e9b0434b11af16c811ecebaf9ab2

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 15:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
Size 1.2MB
Sample240510-s79erage73
SHA256 93f21391880b070015bb1e3febff4a86b978e9b0434b11af16c811ecebaf9ab2
MD5 14b201ddebccd0661d3fb111c0e8be80
SHA1 7d0cc8cdbba4023d40b5d3d28d46455671e96141
SHA512 f9ea57a7f89657d47a4ae2316ecf110b7793e36622530bbf6765ba115e70c5da2d2852dde7409140662e7dc283758eb5b332c1761f8b979ab5a9f57e4238323b
SSDEEP 24576:NR28aergLxCcjZGKCKFuTBHNWdd2HAxWnUDTJ/yS3Rh:TJaDKf4p4UD1v
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 64 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2652	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1612	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1872	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5016	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4460	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2128	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3496	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2300	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3548	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5060	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4344	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4616	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4620	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3608	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1596	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4672	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5072	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1288	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1752	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4832	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4772	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2716	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1072	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1780	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1516	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	924	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2876	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4920	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	952	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4744	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4628	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3048	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3276	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4412	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4596	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2536	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3888	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4928	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3212	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3316	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1424	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4468	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3120	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1228	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3348	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5104	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4108	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4672	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2476	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2824	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2460	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4948	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4088	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3020	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1412	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2552	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4732	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4708	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1060	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4032	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2404	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2216	3652	schtasks.exe	83

UAC bypass 3 TTPs 45 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/3956-1-0x00000000007A0000-0x00000000008DA000-memory.dmp	dcrat
behavioral2/files/0x0007000000023425-30.dat	dcrat
behavioral2/files/0x0018000000016964-110.dat	dcrat

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe

Executes dropped EXE 14 IoCs

pid	Process
2556	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
5060	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
2144	fontdrvhost.exe
2152	fontdrvhost.exe
2324	fontdrvhost.exe
3752	fontdrvhost.exe
3696	fontdrvhost.exe
4424	fontdrvhost.exe
4560	fontdrvhost.exe
2824	fontdrvhost.exe
1396	fontdrvhost.exe
1028	fontdrvhost.exe
5000	fontdrvhost.exe
3820	fontdrvhost.exe

Checks whether UAC is enabled 1 TTPs 30 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fontdrvhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fontdrvhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fontdrvhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fontdrvhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fontdrvhost.exe

Drops file in Program Files directory 46 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\CrashReports\c5b4cb5e9653cc	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\7a0fd90576e088	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\sysmon.exe	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\fontdrvhost.exe	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File created	C:\Program Files\Windows Portable Devices\sppsvc.exe	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\121e5b5079f7c0	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Microsoft.NET\ea1d8f6d871115	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\unsecapp.exe	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\unsecapp.exe	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\RCX6AAA.tmp	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\csrss.exe	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Visualizations\RuntimeBroker.exe	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\images\ee2ad38f3d4382	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File created	C:\Program Files\Windows Defender\27d1bcfc3c54e0	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Windows Portable Devices\22eafd247d37c3	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Windows Portable Devices\RuntimeBroker.exe	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\29c1c3cc0f7685	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Visualizations\RCX6CAE.tmp	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre8\6cb0b6c459d5d3	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File created	C:\Program Files\Windows Portable Devices\0a1fd5f707cd16	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Windows Portable Devices\sppsvc.exe	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\images\Registry.exe	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\5b884080fd4f94	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\csrss.exe	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RCX6288.tmp	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\upfc.exe	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre8\dwm.exe	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File created	C:\Program Files\Windows Portable Devices\RuntimeBroker.exe	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File created	C:\Program Files\Windows Portable Devices\9e8d7a4ca61bd9	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\RCX649C.tmp	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\fontdrvhost.exe	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\TextInputHost.exe	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Microsoft.NET\upfc.exe	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Google\CrashReports\services.exe	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\sysmon.exe	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Internet Explorer\images\Registry.exe	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Windows Defender\System.exe	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\886983d96e3d3e	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Windows Media Player\Visualizations\RuntimeBroker.exe	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Windows Media Player\Visualizations\9e8d7a4ca61bd9	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre8\dwm.exe	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\explorer.exe	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Google\CrashReports\services.exe	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\explorer.exe	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File created	C:\Program Files\Windows Defender\System.exe	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Windows Portable Devices\TextInputHost.exe	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe

Drops file in Windows directory 24 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\886983d96e3d3e	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File created	C:\Windows\de-DE\smss.exe	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File created	C:\Windows\Panther\UnattendGC\5b884080fd4f94	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File created	C:\Windows\debug\Registry.exe	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File created	C:\Windows\ServiceProfiles\LocalService\Videos\backgroundTaskHost.exe	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File created	C:\Windows\ServiceProfiles\LocalService\Videos\eddb19405b7ce1	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File created	C:\Windows\Tasks\csrss.exe	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File created	C:\Windows\de-DE\69ddcba757bf72	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File opened for modification	C:\Windows\de-DE\smss.exe	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File created	C:\Windows\debug\ee2ad38f3d4382	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\Videos\backgroundTaskHost.exe	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File opened for modification	C:\Windows\Tasks\RCX68A5.tmp	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File created	C:\Windows\Prefetch\ReadyBoot\fontdrvhost.exe	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File created	C:\Windows\Panther\UnattendGC\fontdrvhost.exe	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File opened for modification	C:\Windows\Panther\UnattendGC\fontdrvhost.exe	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File opened for modification	C:\Windows\debug\RCX59E8.tmp	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File created	C:\Windows\addins\Idle.exe	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File created	C:\Windows\addins\6ccacd8608530f	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File created	C:\Windows\Prefetch\ReadyBoot\5b884080fd4f94	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File opened for modification	C:\Windows\Prefetch\ReadyBoot\fontdrvhost.exe	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File opened for modification	C:\Windows\debug\Registry.exe	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\Videos\RCX6083.tmp	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File opened for modification	C:\Windows\Tasks\csrss.exe	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
File opened for modification	C:\Windows\addins\Idle.exe	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2216	schtasks.exe
2796	schtasks.exe
4460	schtasks.exe
4920	schtasks.exe
1228	schtasks.exe
1060	schtasks.exe
3880	schtasks.exe
2212	schtasks.exe
4616	schtasks.exe
1780	schtasks.exe
1996	schtasks.exe
1412	schtasks.exe
2552	schtasks.exe
936	schtasks.exe
1188	schtasks.exe
3496	schtasks.exe
5060	schtasks.exe
2676	schtasks.exe
3120	schtasks.exe
3592	schtasks.exe
412	schtasks.exe
4888	schtasks.exe
2300	schtasks.exe
4672	schtasks.exe
3316	schtasks.exe
1240	schtasks.exe
952	schtasks.exe
2476	schtasks.exe
4948	schtasks.exe
1424	schtasks.exe
4088	schtasks.exe
2840	schtasks.exe
4344	schtasks.exe
4596	schtasks.exe
3212	schtasks.exe
4732	schtasks.exe
4928	schtasks.exe
4468	schtasks.exe
4108	schtasks.exe
1072	schtasks.exe
4412	schtasks.exe
1596	schtasks.exe
4772	schtasks.exe
2716	schtasks.exe
3348	schtasks.exe
452	schtasks.exe
1664	schtasks.exe
3020	schtasks.exe
4068	schtasks.exe
2652	schtasks.exe
4620	schtasks.exe
4672	schtasks.exe
1288	schtasks.exe
1516	schtasks.exe
1612	schtasks.exe
2128	schtasks.exe
3548	schtasks.exe
3048	schtasks.exe
4708	schtasks.exe
2820	schtasks.exe
2520	schtasks.exe
5108	schtasks.exe
1872	schtasks.exe
5016	schtasks.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	fontdrvhost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3956	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
3956	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
3956	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
3956	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
3956	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
3956	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
3956	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
3956	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
3956	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
3956	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
3956	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
3956	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
3956	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
3956	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
3956	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
3956	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
3956	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
3956	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
3956	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
3956	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
3956	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
3956	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
3956	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
3956	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
3956	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
3956	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
3956	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
3956	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
3956	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
3956	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
3956	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
3956	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
3956	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
3956	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
3956	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
3956	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
3956	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
3956	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
3956	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
3956	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
2556	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
2556	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
2556	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
2556	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
2556	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
2556	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
2556	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
2556	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
2556	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
2556	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
2556	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
2556	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
2556	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
2556	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
2556	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
2556	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
2556	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
2556	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
2556	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
5060	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
5060	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
5060	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
5060	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
5060	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	3956	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
Token: SeDebugPrivilege	2556	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
Token: SeDebugPrivilege	5060	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
Token: SeDebugPrivilege	2144	fontdrvhost.exe
Token: SeDebugPrivilege	2152	fontdrvhost.exe
Token: SeDebugPrivilege	2324	fontdrvhost.exe
Token: SeDebugPrivilege	3752	fontdrvhost.exe
Token: SeDebugPrivilege	3696	fontdrvhost.exe
Token: SeDebugPrivilege	4424	fontdrvhost.exe
Token: SeDebugPrivilege	4560	fontdrvhost.exe
Token: SeDebugPrivilege	2824	fontdrvhost.exe
Token: SeDebugPrivilege	1396	fontdrvhost.exe
Token: SeDebugPrivilege	1028	fontdrvhost.exe
Token: SeDebugPrivilege	5000	fontdrvhost.exe
Token: SeDebugPrivilege	3820	fontdrvhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3956 wrote to memory of 4480	3956	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe	118
PID 3956 wrote to memory of 4480	3956	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe	118
PID 4480 wrote to memory of 3244	4480	cmd.exe	120
PID 4480 wrote to memory of 3244	4480	cmd.exe	120
PID 4480 wrote to memory of 2556	4480	cmd.exe	121
PID 4480 wrote to memory of 2556	4480	cmd.exe	121
PID 2556 wrote to memory of 3060	2556	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe	137
PID 2556 wrote to memory of 3060	2556	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe	137
PID 3060 wrote to memory of 4676	3060	cmd.exe	139
PID 3060 wrote to memory of 4676	3060	cmd.exe	139
PID 3060 wrote to memory of 5060	3060	cmd.exe	140
PID 3060 wrote to memory of 5060	3060	cmd.exe	140
PID 5060 wrote to memory of 532	5060	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe	181
PID 5060 wrote to memory of 532	5060	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe	181
PID 532 wrote to memory of 1492	532	cmd.exe	183
PID 532 wrote to memory of 1492	532	cmd.exe	183
PID 532 wrote to memory of 2144	532	cmd.exe	185
PID 532 wrote to memory of 2144	532	cmd.exe	185
PID 2144 wrote to memory of 2940	2144	fontdrvhost.exe	186
PID 2144 wrote to memory of 2940	2144	fontdrvhost.exe	186
PID 2144 wrote to memory of 4748	2144	fontdrvhost.exe	187
PID 2144 wrote to memory of 4748	2144	fontdrvhost.exe	187
PID 2940 wrote to memory of 2152	2940	WScript.exe	188
PID 2940 wrote to memory of 2152	2940	WScript.exe	188
PID 2152 wrote to memory of 1584	2152	fontdrvhost.exe	189
PID 2152 wrote to memory of 1584	2152	fontdrvhost.exe	189
PID 2152 wrote to memory of 3600	2152	fontdrvhost.exe	190
PID 2152 wrote to memory of 3600	2152	fontdrvhost.exe	190
PID 1584 wrote to memory of 2324	1584	WScript.exe	191
PID 1584 wrote to memory of 2324	1584	WScript.exe	191
PID 2324 wrote to memory of 2428	2324	fontdrvhost.exe	192
PID 2324 wrote to memory of 2428	2324	fontdrvhost.exe	192
PID 2324 wrote to memory of 224	2324	fontdrvhost.exe	193
PID 2324 wrote to memory of 224	2324	fontdrvhost.exe	193
PID 2428 wrote to memory of 3752	2428	WScript.exe	194
PID 2428 wrote to memory of 3752	2428	WScript.exe	194
PID 3752 wrote to memory of 3564	3752	fontdrvhost.exe	195
PID 3752 wrote to memory of 3564	3752	fontdrvhost.exe	195
PID 3752 wrote to memory of 3420	3752	fontdrvhost.exe	196
PID 3752 wrote to memory of 3420	3752	fontdrvhost.exe	196
PID 3564 wrote to memory of 3696	3564	WScript.exe	197
PID 3564 wrote to memory of 3696	3564	WScript.exe	197
PID 3696 wrote to memory of 4512	3696	fontdrvhost.exe	198
PID 3696 wrote to memory of 4512	3696	fontdrvhost.exe	198
PID 3696 wrote to memory of 4444	3696	fontdrvhost.exe	199
PID 3696 wrote to memory of 4444	3696	fontdrvhost.exe	199
PID 4512 wrote to memory of 4424	4512	WScript.exe	200
PID 4512 wrote to memory of 4424	4512	WScript.exe	200
PID 4424 wrote to memory of 2304	4424	fontdrvhost.exe	201
PID 4424 wrote to memory of 2304	4424	fontdrvhost.exe	201
PID 4424 wrote to memory of 3352	4424	fontdrvhost.exe	202
PID 4424 wrote to memory of 3352	4424	fontdrvhost.exe	202
PID 2304 wrote to memory of 4560	2304	WScript.exe	203
PID 2304 wrote to memory of 4560	2304	WScript.exe	203
PID 4560 wrote to memory of 3528	4560	fontdrvhost.exe	204
PID 4560 wrote to memory of 3528	4560	fontdrvhost.exe	204
PID 4560 wrote to memory of 3720	4560	fontdrvhost.exe	205
PID 4560 wrote to memory of 3720	4560	fontdrvhost.exe	205
PID 3528 wrote to memory of 2824	3528	WScript.exe	206
PID 3528 wrote to memory of 2824	3528	WScript.exe	206
PID 2824 wrote to memory of 1596	2824	fontdrvhost.exe	207
PID 2824 wrote to memory of 1596	2824	fontdrvhost.exe	207
PID 2824 wrote to memory of 212	2824	fontdrvhost.exe	208
PID 2824 wrote to memory of 212	2824	fontdrvhost.exe	208

System policy modification 1 TTPs 45 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3956
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\f3c4kdafJa.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4480
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:3244
- - C:\Users\Admin\AppData\Local\Temp\14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe"
    3⤵
    - UAC bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2556
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nTU0UPEK42.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3060
    - - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        5⤵
        
        PID:4676
    - - C:\Users\Admin\AppData\Local\Temp\14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe"
        5⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:5060
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ST8IV2do8C.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:532
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:1492
        
        C:\Windows\Prefetch\ReadyBoot\fontdrvhost.exe
        
        "C:\Windows\Prefetch\ReadyBoot\fontdrvhost.exe"
        7⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2144
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\778c24ab-1601-41d2-940e-d4ccbe3eeaf2.vbs"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2940
        
        C:\Windows\Prefetch\ReadyBoot\fontdrvhost.exe
        
        C:\Windows\Prefetch\ReadyBoot\fontdrvhost.exe
        9⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2152
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\db7dddd1-a925-4d26-8ee5-3a0a5cd8a513.vbs"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:1584
        
        C:\Windows\Prefetch\ReadyBoot\fontdrvhost.exe
        
        C:\Windows\Prefetch\ReadyBoot\fontdrvhost.exe
        11⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2324
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\aeb9576f-c52b-44fa-82c4-41c8754043aa.vbs"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:2428
        
        C:\Windows\Prefetch\ReadyBoot\fontdrvhost.exe
        
        C:\Windows\Prefetch\ReadyBoot\fontdrvhost.exe
        13⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3752
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d504236c-3518-4eae-91b0-7ed675d1914b.vbs"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:3564
        
        C:\Windows\Prefetch\ReadyBoot\fontdrvhost.exe
        
        C:\Windows\Prefetch\ReadyBoot\fontdrvhost.exe
        15⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3696
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3c9368e4-7003-40cf-b1b0-259c434f7cd0.vbs"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:4512
        
        C:\Windows\Prefetch\ReadyBoot\fontdrvhost.exe
        
        C:\Windows\Prefetch\ReadyBoot\fontdrvhost.exe
        17⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4424
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ad4fd329-54f3-4b2b-8619-6c680c38db15.vbs"
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:2304
        
        C:\Windows\Prefetch\ReadyBoot\fontdrvhost.exe
        
        C:\Windows\Prefetch\ReadyBoot\fontdrvhost.exe
        19⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4560
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\423321b8-87ba-4d37-af64-3bb245215166.vbs"
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:3528
        
        C:\Windows\Prefetch\ReadyBoot\fontdrvhost.exe
        
        C:\Windows\Prefetch\ReadyBoot\fontdrvhost.exe
        21⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2824
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7d9f83d6-bf50-40f0-8c80-72caf819da81.vbs"
        22⤵
        
        PID:1596
        
        C:\Windows\Prefetch\ReadyBoot\fontdrvhost.exe
        
        C:\Windows\Prefetch\ReadyBoot\fontdrvhost.exe
        23⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1396
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fa4a9b54-29e5-4aed-a7fe-06a0f2ec6422.vbs"
        24⤵
        
        PID:3796
        
        C:\Windows\Prefetch\ReadyBoot\fontdrvhost.exe
        
        C:\Windows\Prefetch\ReadyBoot\fontdrvhost.exe
        25⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1028
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\801b3c12-53e3-4579-abe4-633ae729e5ec.vbs"
        26⤵
        
        PID:440
        
        C:\Windows\Prefetch\ReadyBoot\fontdrvhost.exe
        
        C:\Windows\Prefetch\ReadyBoot\fontdrvhost.exe
        27⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:5000
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6d3f4210-768b-446c-98b1-9186f573f710.vbs"
        28⤵
        
        PID:2516
        
        C:\Windows\Prefetch\ReadyBoot\fontdrvhost.exe
        
        C:\Windows\Prefetch\ReadyBoot\fontdrvhost.exe
        29⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3820
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4ded5436-c483-49fc-94aa-b81d2540d27f.vbs"
        30⤵
        
        PID:1032
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bcae0267-b90a-491d-b97a-d30f9bb17fec.vbs"
        30⤵
        
        PID:1988
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e108e005-461f-4a88-b46a-cd90492ef142.vbs"
        28⤵
        
        PID:4420
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cc4d7dc7-7087-4ca1-aae0-fb434506daab.vbs"
        26⤵
        
        PID:2688
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8318e73a-0c51-4db5-8973-96f3a6776798.vbs"
        24⤵
        
        PID:452
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\20871491-c2d3-4c55-b6da-856827aeaf17.vbs"
        22⤵
        
        PID:212
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\36da70c9-c866-427d-a7f1-05ff4cfb3862.vbs"
        20⤵
        
        PID:3720
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\98aa8636-ee41-48e0-adf4-30a0e0d5ca48.vbs"
        18⤵
        
        PID:3352
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\668c88cc-ab2a-4c38-81ab-a574d5d43ce6.vbs"
        16⤵
        
        PID:4444
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\026b9bb2-cef7-4325-baf6-5a66e1d565e4.vbs"
        14⤵
        
        PID:3420
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\73d00b25-4bb1-43f8-bb58-0b4c6f32d4fa.vbs"
        12⤵
        
        PID:224
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d2465d54-90ac-4b1e-bdb0-0a2fbec1a03c.vbs"
        10⤵
        
        PID:3600
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e1a7c37d-1696-43d9-bd41-e54352d7db7e.vbs"
        8⤵
        
        PID:4748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Windows\debug\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\debug\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\Windows\debug\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default User\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Videos\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Admin\Videos\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Videos\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 8 /tr "'C:\Windows\ServiceProfiles\LocalService\Videos\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Windows\ServiceProfiles\LocalService\Videos\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 8 /tr "'C:\Windows\ServiceProfiles\LocalService\Videos\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft.NET\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:3608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft.NET\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:5072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Documents\My Music\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Public\Documents\My Music\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Documents\My Music\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Windows\Tasks\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Tasks\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Windows\Tasks\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Media Player\Visualizations\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
PID:2876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\Visualizations\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Media Player\Visualizations\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Program Files\Java\jre8\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
PID:4744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Java\jre8\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Program Files\Java\jre8\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Recent\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
PID:3276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default\Recent\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Recent\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
PID:2536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:3888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Recent\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Admin\Recent\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Recent\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Google\CrashReports\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\CrashReports\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Google\CrashReports\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Windows\addins\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\addins\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:5104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Windows\addins\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Windows\Prefetch\ReadyBoot\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\Prefetch\ReadyBoot\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Windows\Prefetch\ReadyBoot\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
PID:2460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Portable Devices\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Portable Devices\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 10 /tr "'C:\Program Files\Common Files\microsoft shared\VSTO\10.0\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\VSTO\10.0\sysmon.exe'" /rl HIGHEST /f
1⤵
PID:4652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 14 /tr "'C:\Program Files\Common Files\microsoft shared\VSTO\10.0\sysmon.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Windows\de-DE\smss.exe'" /f
1⤵
- Creates scheduled task(s)
PID:936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\de-DE\smss.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Windows\de-DE\smss.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Program Files\Internet Explorer\images\Registry.exe'" /f
1⤵
PID:4968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\images\Registry.exe'" /rl HIGHEST /f
1⤵
PID:3852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Program Files\Internet Explorer\images\Registry.exe'" /rl HIGHEST /f
1⤵
PID:3200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Defender\System.exe'" /f
1⤵
- Creates scheduled task(s)
PID:1188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\System.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Defender\System.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:3880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Portable Devices\TextInputHost.exe'" /f
1⤵
- Creates scheduled task(s)
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Portable Devices\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:3592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Windows\Panther\UnattendGC\fontdrvhost.exe'" /f
1⤵
- Creates scheduled task(s)
PID:1240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\Panther\UnattendGC\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Windows\Panther\UnattendGC\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:5108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\fontdrvhost.exe'" /f
1⤵
- Creates scheduled task(s)
PID:2796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:4888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:4068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

upfc.exe

Path C:\Program Files (x86)\Microsoft.NET\upfc.exe
Size 1.2MB
SHA256 93f21391880b070015bb1e3febff4a86b978e9b0434b11af16c811ecebaf9ab2
MD5 14b201ddebccd0661d3fb111c0e8be80
SHA1 7d0cc8cdbba4023d40b5d3d28d46455671e96141
SHA512 f9ea57a7f89657d47a4ae2316ecf110b7793e36622530bbf6765ba115e70c5da2d2852dde7409140662e7dc283758eb5b332c1761f8b979ab5a9f57e4238323b
SSDEEP 24576:NR28aergLxCcjZGKCKFuTBHNWdd2HAxWnUDTJ/yS3Rh:TJaDKf4p4UD1v
MD5 SHA1 SHA512 SSDEEP

Submit Download

RCX6CAE.tmp

Path C:\Program Files (x86)\Windows Media Player\Visualizations\RCX6CAE.tmp
Size 1.2MB
SHA256 406e3f8a2d5c1d8393af895e828cf43d83bb1860d3a5a37e6e8b3c30d83f0059
MD5 ec2f96fa23c4ea0f463e52eba00ee0f1
SHA1 1a10d449526c513504208d7e0678e287edd21e65
SHA512 708f69919956a52de22d60b5baa4871c6e9d9b2dfcd6706863669dbb497aa0f57970ea7d2dba33c878655887b2c8d7ab6f4e101f5213b3c9c8fb9802e233771f
SSDEEP 24576:FR28aergLxCcjZGKCKFuTBHNWdd2HAxWnUDTJ/yS3Rh:rJaDKf4p4UD1v
MD5 SHA1 SHA512 SSDEEP

Submit Download

14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\14b201ddebccd0661d3fb111c0e8be80_NeikiAnalytics.exe.log
Size 1KB
SHA256 29f5645ac14353ac460858f52c856548f3aeb144b09eef672a6b4849bafe742e
MD5 7800fca2323a4130444c572374a030f4
SHA1 40c9b8e0e5e7d72a5293f4010f2ccf21e637b4aa
SHA512 c8a7ad930b8c07007c7a67d8c32a2a4a401dcc34ab966e0e80901655fcbe1f5c95b72a195e6381b1de56c2c987eeab093d8e89891bec9e9684785c5d824b3554
MD5 SHA1 SHA512

Submit Download

fontdrvhost.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\fontdrvhost.exe.log
Size 1KB
SHA256 2ca8df156dba033c5b3ae4009e3be14dcdc6b9be53588055efd0864a1ab8ff73
MD5 3690a1c3b695227a38625dcf27bd6dac
SHA1 c2ed91e98b120681182904fa2c7cd504e5c4b2f5
SHA512 15ebfe05c0317f844e957ac02842a60b01f00ddca981e888e547056d0e30c97829bc4a2a46ce43034b3346f7cf5406c7c41c2a830f0abc47c8d2fd2ef00cb2c1
MD5 SHA1 SHA512

Submit Download

3c9368e4-7003-40cf-b1b0-259c434f7cd0.vbs

Path C:\Users\Admin\AppData\Local\Temp\3c9368e4-7003-40cf-b1b0-259c434f7cd0.vbs
Size 721B
SHA256 0836deaef21ade93132b7678cc0399b99863c7aba4ec1bf399a686061c61169b
MD5 68449ed63aab4b31769d0a178e8818f0
SHA1 8e4658c63d05b85f38689bd0955fa9b56a02f8f6
SHA512 79f5a64acbe151fa8ff57bd7afdab9831c4fe32be393c422fa0df56b6e055ed79c3865bf827e6a458ba1dc6a9da78bb633e52f41c6e47a9f719d849739e128e9
MD5 SHA1 SHA512

Submit Download

423321b8-87ba-4d37-af64-3bb245215166.vbs

Path C:\Users\Admin\AppData\Local\Temp\423321b8-87ba-4d37-af64-3bb245215166.vbs
Size 721B
SHA256 fbf16ee5e56458c55257c0d6e9edf7cb83c9e9d93761a53985f45dbbf2c95657
MD5 93b490e9202d2a6880b82795c3599188
SHA1 53802486a8ff9443ee2871f2299d183ac6709912
SHA512 2c8a2ff61a6ff686e58e4b984c88585f34e122c1c8133606d13dbd833f2306befbbfeed415143e047bbfc4f1286318febdaeb3999f501d0ce0b2f73fc88ab697
MD5 SHA1 SHA512

Submit Download

4ded5436-c483-49fc-94aa-b81d2540d27f.vbs

Path C:\Users\Admin\AppData\Local\Temp\4ded5436-c483-49fc-94aa-b81d2540d27f.vbs
Size 721B
SHA256 55eddc5f6e133ae0bcd9125545ce34a6234ceb2b32815a0cb2d9d55d4deb2219
MD5 64332a8d5c243d02a870abe92903cc6b
SHA1 1deebd9f1f28e67ad3cadd136a96161ca73e00bf
SHA512 a201d692ada0ab5b2b4829513753b4fa81098f3d74c07e98f29d433966a98d34ff066b16c90732a36410c03a0f4037bf45ea278a34b3c0617bc627aeb492df46
MD5 SHA1 SHA512

Submit Download

59a07570a8a8386aa1a299e6ab573f686e7e81544.5.321e942f7529053d3bf5a939edfacdca5e36682859

Path C:\Users\Admin\AppData\Local\Temp\59a07570a8a8386aa1a299e6ab573f686e7e81544.5.321e942f7529053d3bf5a939edfacdca5e36682859
Size 444B
SHA256 b01bc3c12d1bf800719f4330a08441c03c96b1fd2b0a07ae1a2fe898b6592e94
MD5 a691e7ca8e2be5f5903555a4f96adae3
SHA1 f7fd8cde9d62347f5077c7fba07fe7350e83eb3c
SHA512 b89c75288d70bc1e843abd20654614ae4e20a4cd0694ffd77d9eec21ba7e507052a38b392a300e4b5bfe5f75c037188c2341bfadd3ad242fc3eaad2bbe728f83
MD5 SHA1 SHA512

Submit Download

59a07570a8a8386aa1a299e6ab573f686e7e81544.5.321e942f7529053d3bf5a939edfacdca5e36682859

Path C:\Users\Admin\AppData\Local\Temp\59a07570a8a8386aa1a299e6ab573f686e7e81544.5.321e942f7529053d3bf5a939edfacdca5e36682859
Size 1KB
SHA256 9eb38a8599c4e31719fcd6f7f3e8e8f5e5e24886d2b605abf9fccf63775cadd6
MD5 cd737b7c439f28cb234b307c096c7960
SHA1 215883a02d1357750818b2be2abd059a17bd5ff3
SHA512 d26bfdd5131e306e53a28ff2a973dcda629e0508d0803f64ef157c832f35db52fb5180771e97e56e06436c60cf4596c756aea81383d44df93901b3351067dd1b
MD5 SHA1 SHA512

Submit Download

6d3f4210-768b-446c-98b1-9186f573f710.vbs

Path C:\Users\Admin\AppData\Local\Temp\6d3f4210-768b-446c-98b1-9186f573f710.vbs
Size 721B
SHA256 7f14746fe48e8efb947c1cf1c14bfd4ce1b8ab7f2c770329a9efc4f37d11f454
MD5 426979142ec76ff98e751a51818d2ced
SHA1 0a95b6e0f9c987eb2985aa7c43bcebd83fa72940
SHA512 26774246a3c88de0227929e9a01b2c8ce90267efc5494d9d8e3a0cb086da0383d3e4f6e49e022b87bd6d6d971729677d2c5844d9b41858ead5c9b18da6e4cb32
MD5 SHA1 SHA512

Submit Download

778c24ab-1601-41d2-940e-d4ccbe3eeaf2.vbs

Path C:\Users\Admin\AppData\Local\Temp\778c24ab-1601-41d2-940e-d4ccbe3eeaf2.vbs
Size 721B
SHA256 0be9e28d0bbc41a07f5cc0118ed87e68aae8440544b6c6601e5bf2cd845403bc
MD5 efe34d70ec0f06aa2de026dcbee78299
SHA1 bbb981773de3aa92665a10e610ca4e176096e393
SHA512 790a7212aa3f7d9899e4e7d4d1308f3f3681f01e42f0fa3143d9d8fe8fd2c826a8b0069830b29a96f400ee5705acc4aff1f1aa0048b245b0bc081f4c4967bc3f
MD5 SHA1 SHA512

Submit Download

7d9f83d6-bf50-40f0-8c80-72caf819da81.vbs

Path C:\Users\Admin\AppData\Local\Temp\7d9f83d6-bf50-40f0-8c80-72caf819da81.vbs
Size 721B
SHA256 8932c5b9a5ba78b7e9c9bba30008bf0ee32994cf588ee8e2d06ca8d97ea63a19
MD5 7c82b63148659ff2f6598de09cacbf8b
SHA1 de3108431fd2952801d2951a916a8b4c2dac34ae
SHA512 193cfdb2701a119b1162a83189ab9b25cef0fcfb4f2fb7ce4a917fdf9fd9ead8a034cfedf98fb085c38f52324ed55deea5e011b947373f11e7369eb0b356445f
MD5 SHA1 SHA512

Submit Download

801b3c12-53e3-4579-abe4-633ae729e5ec.vbs

Path C:\Users\Admin\AppData\Local\Temp\801b3c12-53e3-4579-abe4-633ae729e5ec.vbs
Size 721B
SHA256 b975f1ff25ddc731e8778c7f26ae900774bd599d08c5f89f93d50c30eb9425a7
MD5 b62225c3e3a5a9e7fb936b822ffc3893
SHA1 02273d335b311a7b02aadae7fcba8bb97c541a17
SHA512 c07eec1b48ed8bcdf23a061761946003b50415fa45932ebf0c4d4f00d3842748e47d47a5a8709a5872b8f45ace62bfee1fec10ffc1d10098f1bf6e77248ce8cb
MD5 SHA1 SHA512

Submit Download

ST8IV2do8C.bat

Path C:\Users\Admin\AppData\Local\Temp\ST8IV2do8C.bat
Size 210B
SHA256 516a2bb34e071eac5be8ec866f71bcf1b80077f5bf98aae5cc250c58345266c0
MD5 5c43b740190f5b39d42c1ba27a6184ac
SHA1 1fc802020b37ed9fd4c5a097432e114e5eab75a4
SHA512 516c816a29b69c284c9a9dcfdbbd4a8a68fb50e9ba7be5ee3502888ccb79b53fddc091555f0d460a0f7b16c0bb5c9e99b323d5fa49a47fc751d000b488dcc1e4
MD5 SHA1 SHA512

Submit Download

ad4fd329-54f3-4b2b-8619-6c680c38db15.vbs

Path C:\Users\Admin\AppData\Local\Temp\ad4fd329-54f3-4b2b-8619-6c680c38db15.vbs
Size 721B
SHA256 c8cb5827f919b7af2d443771d101c760542e93d57ecd1f45ec65c1b71d3ad960
MD5 8edd9fe4d39ced99ddff1587e950536b
SHA1 0267db0fc8d9f976c3c9cbc262f6f059e081fa55
SHA512 d06afe824cf11c36b80125fd03d3b5f35d90ad52ec7f3089024cca021be49d2df95f46c137d241487dd7fd5a34ab051d146c8b5800d5d892e046120399ea0d02
MD5 SHA1 SHA512

Submit Download

aeb9576f-c52b-44fa-82c4-41c8754043aa.vbs

Path C:\Users\Admin\AppData\Local\Temp\aeb9576f-c52b-44fa-82c4-41c8754043aa.vbs
Size 721B
SHA256 73c8031f754537f43ef22995fa8513ab95eb0baa2e0e55dd1708704e9054d8db
MD5 442013e3aaf076d21255b3815ca6b488
SHA1 baaafc75d79e0381056cd5889b3cd5657639f194
SHA512 70680d2831b1648ae3f948f97a1006b0409e81c82528f6af448b9e18f600923812eb185f3d9ba59c4e5957f7e4b21cc02c2e26b307a3858f7f7ca8d338958f60
MD5 SHA1 SHA512

Submit Download

d504236c-3518-4eae-91b0-7ed675d1914b.vbs

Path C:\Users\Admin\AppData\Local\Temp\d504236c-3518-4eae-91b0-7ed675d1914b.vbs
Size 721B
SHA256 c64bf5962b7738003b8eb0b7879b9cc6b3142da6137b301d2e484b2472e7fd5b
MD5 6d1b32d4eb54c0a34636372b036262a0
SHA1 4af47461f7bf1c91a7c4296e757d68720f85d34b
SHA512 2c9a90668ac350663ff1b8c70886ab3fc48aa1c889e8e0120ac01011713a9ef4ad8ada6c6c3b652aa9abe20e01732ab6bfe3df46eaa0c7d7efe3d642018b8c16
MD5 SHA1 SHA512

Submit Download

db7dddd1-a925-4d26-8ee5-3a0a5cd8a513.vbs

Path C:\Users\Admin\AppData\Local\Temp\db7dddd1-a925-4d26-8ee5-3a0a5cd8a513.vbs
Size 721B
SHA256 5b41c865dbf1b272058245d68e0685a250805825522b060cd8d8cb069f96e85d
MD5 0b2aa7a80fd66c8b3f0e35f6ab1c97f9
SHA1 954e79fa5de750e2165f28a85693e4e3b78eae59
SHA512 24149b6586e30339fcc2612beee05fde463187d1a97e3f8032899f7bfd7e792a2a85d2e6c1d3bce8693ef90cffd5dc3330fe644d7ca90bf9df3581d79fd2d1d3
MD5 SHA1 SHA512

Submit Download

e1a7c37d-1696-43d9-bd41-e54352d7db7e.vbs

Path C:\Users\Admin\AppData\Local\Temp\e1a7c37d-1696-43d9-bd41-e54352d7db7e.vbs
Size 497B
SHA256 9702ecb85596e0482cd92a2fff0c7ae8261f8d3469133ada20e8fb8fef2ba729
MD5 9edb170e617dd08ff692d9a011759a28
SHA1 725c6adbb854b8696e10db516aa9e2d17d24a8ac
SHA512 02cf5bf8e5fdc59a8c2aa29ebba3ad7bea1a3e582be8ed344c80ad5829cb05f0fda204e2bdb7807529a1d3f819dc1fa1312615333a3963b10384ae55c628ba6e
MD5 SHA1 SHA512

Submit Download

f3c4kdafJa.bat

Path C:\Users\Admin\AppData\Local\Temp\f3c4kdafJa.bat
Size 250B
SHA256 b6c60580f9252cc801c0c31b8c1a7978e20dd7aa02b5fb008e70115775efc4ed
MD5 032813f4936f241511f9dc8e3441c7f4
SHA1 b8a8ccf6b09f430bfbb724cfa3fa7b1b41b577b1
SHA512 1e3b9b1f89231c3e7e06a232cc53713ec9b30873b5bc57c6b6ae4969a6fc239d99b069ccc6d2b83a84a2d414ba0031a6146a82e9c4e7d9e0b749e60d1f94a75b
MD5 SHA1 SHA512

Submit Download

fa4a9b54-29e5-4aed-a7fe-06a0f2ec6422.vbs

Path C:\Users\Admin\AppData\Local\Temp\fa4a9b54-29e5-4aed-a7fe-06a0f2ec6422.vbs
Size 721B
SHA256 101e24bbabf42fe8ffa82f494164dd63f1a9319e4a29380e67b5dc84402de7cb
MD5 271da11ed026e233eb12d3cdcf7f143a
SHA1 4765e1aa1d9de7f29c910439211d8b6858d92a78
SHA512 9a0bac69ad03515600b3ae603866a42824d62cc5f486a844be23a95b6fba3f84419f1c4a1cb4fe505e2166f326dbd9c24dc57b01cacd4e5255b76e013b5063cf
MD5 SHA1 SHA512

Submit Download

nTU0UPEK42.bat

Path C:\Users\Admin\AppData\Local\Temp\nTU0UPEK42.bat
Size 250B
SHA256 7e9984d5ce0ea12248628860c526fe1dd482fa33db1bec17caf672851fe6b481
MD5 6c2b50eb030a8231e8cae0152804e38c
SHA1 b6289a957de432a0a3aa906de20338f60b6095a7
SHA512 a7abfe0ef2fb6781a76731d254175a4e315a32dcb19a1c4d47ff5438cda4f4c83a1cd102b76121bde79f45be532972dfdc477cc150a1e3c7a3fcb0f82e4a8fd0
MD5 SHA1 SHA512

Submit Download

memory/3956-14-0x000000001BC00000-0x000000001BC0C000-memory.dmp

Download

memory/3956-0-0x00007FF8EDF53000-0x00007FF8EDF55000-memory.dmp

Download

memory/3956-120-0x00007FF8EDF50000-0x00007FF8EEA11000-memory.dmp

Download

memory/3956-6-0x000000001B610000-0x000000001B620000-memory.dmp

Download

memory/3956-1-0x00000000007A0000-0x00000000008DA000-memory.dmp

Download

memory/3956-3-0x000000001B5E0000-0x000000001B5FC000-memory.dmp

Download

memory/3956-21-0x000000001BD70000-0x000000001BD7C000-memory.dmp

Download

memory/3956-19-0x000000001BD50000-0x000000001BD58000-memory.dmp

Download

memory/3956-20-0x000000001BD60000-0x000000001BD6A000-memory.dmp

Download

memory/3956-15-0x000000001BD10000-0x000000001BD18000-memory.dmp

Download

memory/3956-17-0x000000001BD30000-0x000000001BD3E000-memory.dmp

Download

memory/3956-4-0x000000001BB90000-0x000000001BBE0000-memory.dmp

Download

memory/3956-18-0x000000001BD40000-0x000000001BD4C000-memory.dmp

Download

memory/3956-16-0x000000001BD20000-0x000000001BD2A000-memory.dmp

Download

memory/3956-2-0x00007FF8EDF50000-0x00007FF8EEA11000-memory.dmp

Download

memory/3956-12-0x000000001BBE0000-0x000000001BBE8000-memory.dmp

Download

memory/3956-13-0x000000001BBF0000-0x000000001BBFC000-memory.dmp

Download

memory/3956-11-0x000000001B670000-0x000000001B67C000-memory.dmp

Download

memory/3956-10-0x000000001B660000-0x000000001B66C000-memory.dmp

Download

memory/3956-5-0x000000001B600000-0x000000001B608000-memory.dmp

Download

memory/3956-7-0x000000001B620000-0x000000001B636000-memory.dmp

Download

memory/3956-8-0x000000001B640000-0x000000001B648000-memory.dmp

Download

memory/3956-9-0x000000001B650000-0x000000001B65A000-memory.dmp

Download