Malware Analysis Report

2024-11-15 05:49

Sample ID 240515-k3qg3sad3t
Target b6c83df257a00210c12b42d28a5df730_NeikiAnalytics
SHA256 8fdd38ee81442567732265fa944a19a51a26ec1254e8d2a54e41d254a52a35d6
Tags
rat dcrat evasion execution infostealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8fdd38ee81442567732265fa944a19a51a26ec1254e8d2a54e41d254a52a35d6

Threat Level: Known bad

The file b6c83df257a00210c12b42d28a5df730_NeikiAnalytics was found to be: Known bad.

Malicious Activity Summary

rat dcrat evasion execution infostealer trojan

UAC bypass

Process spawned unexpected child process

DcRat

Dcrat family

DCRat payload

DCRat payload

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Checks computer location settings

Checks whether UAC is enabled

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Uses Task Scheduler COM API

Modifies registry class

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

System policy modification

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-15 09:07

Signatures

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Dcrat family

dcrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-15 09:07

Reported

2024-05-15 09:10

Platform

win7-20240508-en

Max time kernel

150s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe"

Signatures

DcRat

rat infostealer dcrat

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\RCX38D0.tmp C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\RCX38D1.tmp C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\MSBuild\Microsoft\RCX24D1.tmp C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\MSBuild\Microsoft\RCX24D2.tmp C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Windows Journal\it-IT\dllhost.exe C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File created C:\Program Files\Microsoft Office\Office14\1033\2d1d3ae651f38d C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Microsoft Office\Office14\1033\RCX2FD3.tmp C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Microsoft Office\Office14\1033\RCX3041.tmp C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Microsoft Office\Office14\1033\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\sppsvc.exe C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File created C:\Program Files\Windows Journal\it-IT\5940a34987c991 C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\MSBuild\Microsoft\6cb0b6c459d5d3 C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\sppsvc.exe C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Windows Journal\it-IT\RCX2DCE.tmp C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Windows Journal\it-IT\RCX2DCF.tmp C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File created C:\Program Files\Windows Journal\it-IT\dllhost.exe C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File created C:\Program Files\Microsoft Office\Office14\1033\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\0a1fd5f707cd16 C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\L2Schemas\886983d96e3d3e C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\L2Schemas\RCX2958.tmp C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\L2Schemas\RCX2959.tmp C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\L2Schemas\csrss.exe C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File created C:\Windows\L2Schemas\csrss.exe C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
N/A N/A C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
N/A N/A C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
N/A N/A C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
N/A N/A C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
N/A N/A C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
N/A N/A C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
N/A N/A C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
N/A N/A C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
N/A N/A C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
N/A N/A C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
N/A N/A C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
N/A N/A C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
N/A N/A C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
N/A N/A C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
N/A N/A C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
N/A N/A C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
N/A N/A C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
N/A N/A C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
N/A N/A C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
N/A N/A C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
N/A N/A C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
N/A N/A C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1700 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 876 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 876 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 876 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 1228 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 1228 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 1228 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\cmd.exe
PID 1700 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\cmd.exe
PID 1700 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\cmd.exe
PID 2516 wrote to memory of 2508 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2516 wrote to memory of 2508 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2516 wrote to memory of 2508 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2516 wrote to memory of 1012 N/A C:\Windows\System32\cmd.exe C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe
PID 2516 wrote to memory of 1012 N/A C:\Windows\System32\cmd.exe C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe
PID 2516 wrote to memory of 1012 N/A C:\Windows\System32\cmd.exe C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe
PID 1012 wrote to memory of 1848 N/A C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe C:\Windows\System32\WScript.exe
PID 1012 wrote to memory of 1848 N/A C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe C:\Windows\System32\WScript.exe
PID 1012 wrote to memory of 1848 N/A C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe C:\Windows\System32\WScript.exe
PID 1012 wrote to memory of 1116 N/A C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe C:\Windows\System32\WScript.exe
PID 1012 wrote to memory of 1116 N/A C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe C:\Windows\System32\WScript.exe
PID 1012 wrote to memory of 1116 N/A C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe C:\Windows\System32\WScript.exe
PID 1848 wrote to memory of 2968 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe
PID 1848 wrote to memory of 2968 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe
PID 1848 wrote to memory of 2968 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe
PID 2968 wrote to memory of 1812 N/A C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe C:\Windows\System32\WScript.exe
PID 2968 wrote to memory of 1812 N/A C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe C:\Windows\System32\WScript.exe
PID 2968 wrote to memory of 1812 N/A C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe C:\Windows\System32\WScript.exe
PID 2968 wrote to memory of 2264 N/A C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe C:\Windows\System32\WScript.exe
PID 2968 wrote to memory of 2264 N/A C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe C:\Windows\System32\WScript.exe
PID 2968 wrote to memory of 2264 N/A C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe C:\Windows\System32\WScript.exe
PID 1812 wrote to memory of 1988 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe
PID 1812 wrote to memory of 1988 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe
PID 1812 wrote to memory of 1988 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe
PID 1988 wrote to memory of 1608 N/A C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe C:\Windows\System32\WScript.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\sppsvc.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Windows\L2Schemas\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\L2Schemas\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Windows\L2Schemas\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\audiodg.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\audiodg.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\audiodg.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Journal\it-IT\dllhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Journal\it-IT\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Journal\it-IT\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "b6c83df257a00210c12b42d28a5df730_NeikiAnalyticsb" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Office\Office14\1033\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "b6c83df257a00210c12b42d28a5df730_NeikiAnalytics" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office14\1033\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "b6c83df257a00210c12b42d28a5df730_NeikiAnalyticsb" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office\Office14\1033\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\wininit.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\explorer.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\lsass.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\lsass.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\lsass.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\sppsvc.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OVarqRTQ45.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe

"C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f4b0421b-1aa8-4c6c-8adc-57522200d294.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0f91d1f7-c2ed-485e-b20d-a034420d14fb.vbs"

C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe

"C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\31f6a87d-1896-4471-93fa-f47f584bed63.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\57b04c4d-e206-4b97-9ae0-eec4520ac19b.vbs"

C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe

"C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\79fbe3e9-56e5-45ac-b2e3-6bca4d45cff6.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\096f9734-7ec3-4806-ae02-a4ab743584e9.vbs"

C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe

"C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0f877131-0027-4967-a8cf-2ffa3e904e5e.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b53184b2-7422-4245-934b-96e353e0e4bd.vbs"

C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe

"C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e84f8ea0-bcfc-420a-8ed1-d2bcd045a5b9.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d3119429-7f84-4723-a0d1-472412eabcd4.vbs"

C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe

"C:\Program Files (x86)\MSBuild\Microsoft\dwm.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5aa08017-455a-48f9-b645-2870aa3e95e9.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1b7bd833-3897-412e-b601-45bda62f7bb0.vbs"

Network

Country Destination Domain Proto
US 8.8.8.8:53 a0887556.xsph.ru udp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp

Files

memory/1700-0-0x000007FEF58F3000-0x000007FEF58F4000-memory.dmp

memory/1700-1-0x0000000001220000-0x000000000155C000-memory.dmp

memory/1700-2-0x000007FEF58F0000-0x000007FEF62DC000-memory.dmp

memory/1700-3-0x0000000000440000-0x000000000044E000-memory.dmp

memory/1700-4-0x00000000004D0000-0x00000000004DE000-memory.dmp

memory/1700-5-0x0000000000660000-0x0000000000668000-memory.dmp

memory/1700-6-0x0000000000670000-0x000000000068C000-memory.dmp

memory/1700-7-0x0000000000690000-0x0000000000698000-memory.dmp

memory/1700-8-0x00000000006E0000-0x00000000006F0000-memory.dmp

memory/1700-10-0x00000000006F0000-0x00000000006F8000-memory.dmp

memory/1700-9-0x0000000000C40000-0x0000000000C56000-memory.dmp

memory/1700-11-0x0000000000C60000-0x0000000000C70000-memory.dmp

memory/1700-12-0x0000000000C70000-0x0000000000C7A000-memory.dmp

memory/1700-13-0x0000000000C80000-0x0000000000CD6000-memory.dmp

memory/1700-14-0x0000000000D50000-0x0000000000D5C000-memory.dmp

memory/1700-15-0x0000000000E60000-0x0000000000E68000-memory.dmp

memory/1700-16-0x0000000000E70000-0x0000000000E7C000-memory.dmp

memory/1700-17-0x0000000000E80000-0x0000000000E88000-memory.dmp

memory/1700-18-0x0000000000E90000-0x0000000000EA2000-memory.dmp

memory/1700-19-0x0000000000EC0000-0x0000000000ECC000-memory.dmp

memory/1700-20-0x0000000000F50000-0x0000000000F5C000-memory.dmp

memory/1700-21-0x0000000000F60000-0x0000000000F6C000-memory.dmp

memory/1700-22-0x0000000000F70000-0x0000000000F7C000-memory.dmp

memory/1700-23-0x0000000000F90000-0x0000000000F98000-memory.dmp

memory/1700-25-0x0000000000F80000-0x0000000000F8E000-memory.dmp

memory/1700-24-0x0000000000FD0000-0x0000000000FDA000-memory.dmp

memory/1700-26-0x0000000000FA0000-0x0000000000FA8000-memory.dmp

memory/1700-27-0x0000000000FB0000-0x0000000000FBE000-memory.dmp

memory/1700-28-0x0000000000FC0000-0x0000000000FCC000-memory.dmp

memory/1700-29-0x0000000000FE0000-0x0000000000FE8000-memory.dmp

memory/1700-30-0x00000000011D0000-0x00000000011DA000-memory.dmp

memory/1700-31-0x00000000011E0000-0x00000000011EC000-memory.dmp

memory/1700-34-0x000007FEF58F0000-0x000007FEF62DC000-memory.dmp

C:\Program Files\Windows Journal\it-IT\dllhost.exe

MD5 b6c83df257a00210c12b42d28a5df730
SHA1 67a993a3c4547e8442f767575dafdbfe018ec0e4
SHA256 8fdd38ee81442567732265fa944a19a51a26ec1254e8d2a54e41d254a52a35d6
SHA512 1c0bdbae29e9761260b3f9284d41be1b63c921399e7e1822c5c725d9811bea555b64fd311ab8e86634b36fdfa381e686fe087b480de9cf958a4f944556f5f60c

C:\Program Files\Microsoft Office\Office14\1033\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe

MD5 b83d495524afaba4069f73827665617a
SHA1 54d24f9f7b3c71c43e0e27d348b09dff8be072da
SHA256 73f641a0c43a965879117f540d6a3de0f83be85b833445954ec2aca042ca841e
SHA512 9c02a9c829d55488de2ac93457f74d4ce3e43c15eda78fe2c28da2ce2a16ce84f195919661f7c1e12a1bb87b88621c281d15858d0ff44ee80e7593ae8f57661e

memory/1700-179-0x000007FEF58F0000-0x000007FEF62DC000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 ab216a272380859af03c080eebca5599
SHA1 650d55ddb2a50b58ec030483b75211b1305f8210
SHA256 affd99b1069177f1b4021f40e2b6de39e7ef1ecda16f397ff4e5a04c36c817fd
SHA512 632636b5ca538b4155d4eb40d60c9ae48d3ce98f8c4462e85a20059ebbb4d303ca3836a56af0da0ea39ab5882265d250a6b0cfd31665e3ae857e122945a5ca67

memory/1600-191-0x0000000001F80000-0x0000000001F88000-memory.dmp

memory/2124-190-0x000000001B6D0000-0x000000001B9B2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\OVarqRTQ45.bat

MD5 ac39b30155fb4d45eef50be7767db55b
SHA1 ccae52105587fd046c301996feed2bbb3a845514
SHA256 f0e9a174abffaf359b15bfcbf3366cb975f8acb810b3048bb81d141956a3bafe
SHA512 2bacf846c7c49df72d511e3a403cbb2c046886be3e1b37f10a26dbbe2123be782fd9df7b5cf8ea128778c5d308f2352f12c4aca5be5cb6c91efc9d4f2f205fbc

memory/1012-244-0x00000000012F0000-0x000000000162C000-memory.dmp

memory/1012-245-0x0000000000BC0000-0x0000000000C16000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0f91d1f7-c2ed-485e-b20d-a034420d14fb.vbs

MD5 5943e0752bc50c519b3b688358524b72
SHA1 70dd2ebc0df1d96f8ff0250eab820f86b0ec2ed6
SHA256 29ef4a72fb827b67a165c0d7830a708d3ff8a573967707845be7abc9f92ca89f
SHA512 8e1b089ffb1dd357cc2a3abd1402b77e869b64a022724d05bcf03c95591a096466613cc14304aaa54554a762f50acb0f79cc0b9a15d860a52958604fccdc8c84

C:\Users\Admin\AppData\Local\Temp\f4b0421b-1aa8-4c6c-8adc-57522200d294.vbs

MD5 b5291912c0fc36a867cc1d7d47ca0dff
SHA1 45fa4547b6e5f5b96cdfb46be0d135016d5c94a7
SHA256 400c361aec0b81dc2f844d0171f596d6f21bf008776055eaaec24d0ac278902e
SHA512 c5064816c424db5e9e13e0dc98461ee13c1c61530bc5c28b9a5abc9aa14458181ac0d3d50f1f6e4b498cf2325cd6304c2560f1f23372777e675d6920d7c85a18

C:\Users\Admin\AppData\Local\Temp\31f6a87d-1896-4471-93fa-f47f584bed63.vbs

MD5 19549353c9a833b678423ee7de9cad78
SHA1 75b7032352435c26c7c79e749265e84f9d784a89
SHA256 16b10abc03fe7ed46efd26fbe1c6dd967bd4fa763126d1855db6395d7b34b0f8
SHA512 107eea5964c94bcb819e3a971d946a66890fbd219b8d9ee0ecaea2fbfe240da2fce142fef678907b705ccd19ec6e90e7002a2953758a83d18916a3d57654f376

C:\Users\Admin\AppData\Local\Temp\79fbe3e9-56e5-45ac-b2e3-6bca4d45cff6.vbs

MD5 298d08eea689b2a37ef703be94ee1d02
SHA1 e515245dad0a2ad545b7ddc6d1bc9ecc64aeed8d
SHA256 5b45a00ba13b28fc9567bc196a8d488e9c70daf65ebc430611f8cd9b029723f5
SHA512 6163574d605620dab82ca60de332c68f8753bd342bd7e0c14d7616011642ae7b2b347f8a8146497bc038f707bf14f6e4b9e7a77c68f28ae6e692ff2f7bbbe130

C:\Users\Admin\AppData\Local\Temp\0f877131-0027-4967-a8cf-2ffa3e904e5e.vbs

MD5 a8bc338bc86b292749cadc8b10d79d38
SHA1 da91c6b7fa4c6ad89eb2164a959c64e56d928a51
SHA256 8c4a43ede643ea4264b444827188862feff6c37c9b2278c5b7b3506e557c38e1
SHA512 8b44fc5fe565b629d727265400167d471b2413f45207431bc2e378f88b0cfc551b0291d4b18f5948e4c9bbb2feb70f933376ca9c7fc7354f0812b63fb50f116b

memory/2792-289-0x0000000000390000-0x00000000006CC000-memory.dmp

memory/2792-290-0x0000000002340000-0x0000000002352000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\e84f8ea0-bcfc-420a-8ed1-d2bcd045a5b9.vbs

MD5 4f4f0158c5abfc99f5362d9976feeeb5
SHA1 27e6b267e6e8402b3d5e3d4e883c5c691e6de765
SHA256 8924b1df4d8f1bd0f49b55840a505a4a5c0cff95e1d733e0aa86d2a5a3cab9ed
SHA512 ecf370ddd1e7ffede84ce5a38b084c1526c745d3eaa314c9e1df889b869ab90f3cfda62edd16e729e3cb14e3b17bdc392b15a9b44bfb6252580b6a8ca1d875d1

memory/2564-302-0x0000000000350000-0x000000000068C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5aa08017-455a-48f9-b645-2870aa3e95e9.vbs

MD5 64a44442f0f8a083a0d7e3ea794822da
SHA1 ae9e769d8002262b256281f9b6c716f7a2c5729b
SHA256 7170e0136ed1aa35d22ffe77c35660296aaa2512b4fc1351e54b7cf5672f36c9
SHA512 58c45fab83457bac52f5ad9d560272cb38cd373359774281ca20d152e195b1daf91a92a2a0bc868771113ae69054b7fca62bfd47465fd20d71e9ffe872c6e868

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-15 09:07

Reported

2024-05-15 09:10

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe"

Signatures

DcRat

rat infostealer dcrat

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Reference Assemblies\lsass.exe C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\RCX550C.tmp C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Google\RCX671D.tmp C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Google\RCX671E.tmp C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Reference Assemblies\RCX708B.tmp C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Windows Photo Viewer\fr-FR\5940a34987c991 C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Windows Media Player\Visualizations\38384e6a620884 C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Windows Photo Viewer\fr-FR\dllhost.exe C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows Photo Viewer\fr-FR\RCX62F3.tmp C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File created C:\Program Files\7-Zip\Lang\RuntimeBroker.exe C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\RCX50E2.tmp C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Google\RuntimeBroker.exe C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Reference Assemblies\lsass.exe C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File created C:\Program Files\7-Zip\Lang\9e8d7a4ca61bd9 C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Windows Media Player\Visualizations\SearchApp.exe C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\6203df4a6bafc7 C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\Visualizations\RCX6B47.tmp C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\Visualizations\RCX6BC5.tmp C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\Visualizations\SearchApp.exe C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Google\9e8d7a4ca61bd9 C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows Photo Viewer\fr-FR\dllhost.exe C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\66fc9ff0ee96c2 C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Google\RuntimeBroker.exe C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\RCX50E1.tmp C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\RuntimeBroker.exe C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\RCX550B.tmp C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows Photo Viewer\fr-FR\RCX62F2.tmp C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Reference Assemblies\RCX7109.tmp C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\TAPI\smss.exe C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\TAPI\RCX579F.tmp C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\TAPI\RCX6DDA.tmp C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File created C:\Windows\es-ES\backgroundTaskHost.exe C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File created C:\Windows\TAPI\69ddcba757bf72 C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\TAPI\spoolsv.exe C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\es-ES\RCX6071.tmp C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\TAPI\RCX6E67.tmp C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File created C:\Windows\TAPI\spoolsv.exe C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File created C:\Windows\Boot\Resources\it-IT\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\TAPI\RCX579E.tmp C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\es-ES\backgroundTaskHost.exe C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File created C:\Windows\es-ES\eddb19405b7ce1 C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\es-ES\RCX6060.tmp C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\TAPI\smss.exe C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
File created C:\Windows\TAPI\f3b6ecef712a24 C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
Key created \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4068 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4068 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4068 wrote to memory of 4168 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4068 wrote to memory of 4168 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4068 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4068 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4068 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4068 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4068 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4068 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4068 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4068 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4068 wrote to memory of 708 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4068 wrote to memory of 708 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4068 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4068 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4068 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4068 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4068 wrote to memory of 3208 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4068 wrote to memory of 3208 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4068 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4068 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4068 wrote to memory of 4636 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\cmd.exe
PID 4068 wrote to memory of 4636 N/A C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe C:\Windows\System32\cmd.exe
PID 4636 wrote to memory of 1628 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 4636 wrote to memory of 1628 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 4636 wrote to memory of 3228 N/A C:\Windows\System32\cmd.exe C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe
PID 4636 wrote to memory of 3228 N/A C:\Windows\System32\cmd.exe C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe
PID 3228 wrote to memory of 2296 N/A C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe C:\Windows\System32\WScript.exe
PID 3228 wrote to memory of 2296 N/A C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe C:\Windows\System32\WScript.exe
PID 3228 wrote to memory of 1844 N/A C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe C:\Windows\System32\WScript.exe
PID 3228 wrote to memory of 1844 N/A C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe C:\Windows\System32\WScript.exe
PID 2296 wrote to memory of 1100 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe
PID 2296 wrote to memory of 1100 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe
PID 1100 wrote to memory of 5008 N/A C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe C:\Windows\System32\WScript.exe
PID 1100 wrote to memory of 5008 N/A C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe C:\Windows\System32\WScript.exe
PID 1100 wrote to memory of 1992 N/A C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe C:\Windows\System32\WScript.exe
PID 1100 wrote to memory of 1992 N/A C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe C:\Windows\System32\WScript.exe
PID 5008 wrote to memory of 2572 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe
PID 5008 wrote to memory of 2572 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe
PID 2572 wrote to memory of 4816 N/A C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe C:\Windows\System32\WScript.exe
PID 2572 wrote to memory of 4816 N/A C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe C:\Windows\System32\WScript.exe
PID 2572 wrote to memory of 3052 N/A C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe C:\Windows\System32\WScript.exe
PID 2572 wrote to memory of 3052 N/A C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe C:\Windows\System32\WScript.exe
PID 4816 wrote to memory of 3016 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe
PID 4816 wrote to memory of 3016 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe
PID 3016 wrote to memory of 5072 N/A C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe C:\Windows\System32\WScript.exe
PID 3016 wrote to memory of 5072 N/A C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe C:\Windows\System32\WScript.exe
PID 3016 wrote to memory of 4176 N/A C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe C:\Windows\System32\WScript.exe
PID 3016 wrote to memory of 4176 N/A C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe C:\Windows\System32\WScript.exe
PID 5072 wrote to memory of 1716 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe
PID 5072 wrote to memory of 1716 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe
PID 1716 wrote to memory of 4068 N/A C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe C:\Windows\System32\WScript.exe
PID 1716 wrote to memory of 4068 N/A C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe C:\Windows\System32\WScript.exe
PID 1716 wrote to memory of 4548 N/A C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe C:\Windows\System32\WScript.exe
PID 1716 wrote to memory of 4548 N/A C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe C:\Windows\System32\WScript.exe
PID 4068 wrote to memory of 5068 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe
PID 4068 wrote to memory of 5068 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe
PID 5068 wrote to memory of 3652 N/A C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe C:\Windows\System32\WScript.exe
PID 5068 wrote to memory of 3652 N/A C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe C:\Windows\System32\WScript.exe
PID 5068 wrote to memory of 4816 N/A C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe C:\Windows\System32\WScript.exe
PID 5068 wrote to memory of 4816 N/A C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe C:\Windows\System32\WScript.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files\7-Zip\Lang\RuntimeBroker.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\7-Zip\Lang\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Windows\TAPI\spoolsv.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\TAPI\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Windows\TAPI\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Microsoft\DeviceSync\backgroundTaskHost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft\DeviceSync\backgroundTaskHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Microsoft\DeviceSync\backgroundTaskHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Users\Public\winlogon.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Public\winlogon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Users\Public\winlogon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 10 /tr "'C:\Windows\es-ES\backgroundTaskHost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Windows\es-ES\backgroundTaskHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 8 /tr "'C:\Windows\es-ES\backgroundTaskHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\dllhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\SppExtComObj.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Default User\SppExtComObj.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\SppExtComObj.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Google\RuntimeBroker.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Google\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\TextInputHost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\Default User\TextInputHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\TextInputHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Media Player\Visualizations\SearchApp.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\Visualizations\SearchApp.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Media Player\Visualizations\SearchApp.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Windows\TAPI\smss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\TAPI\smss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Windows\TAPI\smss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Reference Assemblies\lsass.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\lsass.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Reference Assemblies\lsass.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IzyyQHg7CN.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe

"C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0240b491-2552-41e3-93e6-ef2519354cad.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\24b7903e-e002-416e-863f-763042f48d1f.vbs"

C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe

"C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\da755566-76c3-4731-85b9-c6d0a726be21.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6162ee3e-5dc2-412e-8ba7-75ddd783298f.vbs"

C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe

"C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e32f78e0-2192-420b-aea5-417d7416e695.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\130bde91-89ab-4ee7-b3e0-e6229db9dddb.vbs"

C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe

"C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d34d6369-8f2b-4f8e-81cf-2d08541cb926.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\561f772e-dba9-4993-ae63-859c154b74eb.vbs"

C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe

"C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\19869018-5556-4429-b7e5-ef1f95fd9969.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a26ab5e2-2ad4-4d1b-b2f3-4719aad81d87.vbs"

C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe

"C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\sihost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\98d4d29d-6ac1-4df1-9a17-5029024271a5.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\91a7fd54-0b34-44fa-970c-bbf283d913e5.vbs"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 88.221.83.210:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 210.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 a0887556.xsph.ru udp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
US 8.8.8.8:53 42.197.8.141.in-addr.arpa udp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 57.15.31.184.in-addr.arpa udp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
US 8.8.8.8:53 8.173.189.20.in-addr.arpa udp

Files

memory/4068-0-0x00007FFD42733000-0x00007FFD42735000-memory.dmp

memory/4068-1-0x0000000000450000-0x000000000078C000-memory.dmp

memory/4068-2-0x00007FFD42730000-0x00007FFD431F1000-memory.dmp

memory/4068-3-0x0000000001050000-0x000000000105E000-memory.dmp

memory/4068-4-0x0000000001100000-0x000000000110E000-memory.dmp

memory/4068-5-0x0000000001110000-0x0000000001118000-memory.dmp

memory/4068-6-0x00000000029D0000-0x00000000029EC000-memory.dmp

memory/4068-7-0x0000000002A40000-0x0000000002A90000-memory.dmp

memory/4068-8-0x00000000029F0000-0x00000000029F8000-memory.dmp

memory/4068-9-0x0000000002A00000-0x0000000002A10000-memory.dmp

memory/4068-10-0x0000000002A10000-0x0000000002A26000-memory.dmp

memory/4068-11-0x0000000002A30000-0x0000000002A38000-memory.dmp

memory/4068-12-0x000000001B5A0000-0x000000001B5B0000-memory.dmp

memory/4068-13-0x000000001B470000-0x000000001B47A000-memory.dmp

memory/4068-14-0x000000001BAF0000-0x000000001BB46000-memory.dmp

memory/4068-15-0x000000001B480000-0x000000001B48C000-memory.dmp

memory/4068-16-0x000000001B5B0000-0x000000001B5B8000-memory.dmp

memory/4068-17-0x000000001B5C0000-0x000000001B5CC000-memory.dmp

memory/4068-18-0x000000001B5D0000-0x000000001B5D8000-memory.dmp

memory/4068-19-0x000000001BB40000-0x000000001BB52000-memory.dmp

memory/4068-20-0x000000001C0A0000-0x000000001C5C8000-memory.dmp

memory/4068-22-0x000000001BB80000-0x000000001BB8C000-memory.dmp

memory/4068-23-0x000000001BB90000-0x000000001BB9C000-memory.dmp

memory/4068-21-0x000000001BB70000-0x000000001BB7C000-memory.dmp

memory/4068-24-0x000000001BBA0000-0x000000001BBAC000-memory.dmp

memory/4068-25-0x000000001BE20000-0x000000001BE28000-memory.dmp

memory/4068-31-0x000000001BE00000-0x000000001BE08000-memory.dmp

memory/4068-30-0x000000001BDF0000-0x000000001BDFC000-memory.dmp

memory/4068-29-0x000000001BDE0000-0x000000001BDEE000-memory.dmp

memory/4068-28-0x000000001BCD0000-0x000000001BCD8000-memory.dmp

memory/4068-27-0x000000001BCC0000-0x000000001BCCE000-memory.dmp

memory/4068-26-0x000000001BCB0000-0x000000001BCBA000-memory.dmp

memory/4068-33-0x000000001BE70000-0x000000001BE7C000-memory.dmp

memory/4068-32-0x000000001BE10000-0x000000001BE1A000-memory.dmp

memory/4068-34-0x00007FFD42730000-0x00007FFD431F1000-memory.dmp

memory/4068-37-0x00007FFD42730000-0x00007FFD431F1000-memory.dmp

C:\ProgramData\Microsoft\DeviceSync\backgroundTaskHost.exe

MD5 b6c83df257a00210c12b42d28a5df730
SHA1 67a993a3c4547e8442f767575dafdbfe018ec0e4
SHA256 8fdd38ee81442567732265fa944a19a51a26ec1254e8d2a54e41d254a52a35d6
SHA512 1c0bdbae29e9761260b3f9284d41be1b63c921399e7e1822c5c725d9811bea555b64fd311ab8e86634b36fdfa381e686fe087b480de9cf958a4f944556f5f60c

C:\Program Files (x86)\Windows Media Player\Visualizations\SearchApp.exe

MD5 fa5e53b3c7f7b694b0532bd4154dd947
SHA1 b75d716c9f6ba443d29bc206b040ea2f0969f376
SHA256 d5a5d3854eda2836e35c3107d24f3d6f65a9fd40a6d642012f5f59d4cbf1c441
SHA512 ce5e2c6cbab1b42d03c0dccdf4bf2477a3af4772e3e16aa25cca429e450c513e42bdfa83c745af03628ca883172fb82a4e762097fb714d7dbf65498046290e13

C:\Windows\TAPI\smss.exe

MD5 e0f0bb13ee543d8c39f84e8551340816
SHA1 5d605b6c3c84159fc74898ba26f4555ab451ee9e
SHA256 18c8979c3cfa7403b8056b5e4eb9aa935600d9b5340174eb568713c8d40795f9
SHA512 0e8a6460c7586f3613f08cb2eaf44ff98486ef495b040aa3961a09a487e8af758f0d556fcd55e1bb1cdddca11b872a87dc7396c4a8eef1bfd6cef7a0091f35da

C:\Program Files (x86)\Reference Assemblies\lsass.exe

MD5 a1f1b4a004cea167c0a0304ddada0cc5
SHA1 a53250f0612686818c488b97bbb3264f14580310
SHA256 8650aa811d70bf7dafa7906923b990f453f7fc5e9d0f4cc5348784fe277a436d
SHA512 91c7f203d0c2f05ebc69ba8f14922e247bf16be3b9c7c98abd7ec77924440276c0812421fc962c9c8e8bc5c3f69445b99a5a9e4551219c1c8a57d19d25d284d6

memory/4068-251-0x00007FFD42730000-0x00007FFD431F1000-memory.dmp

memory/4168-269-0x000001DDACFF0000-0x000001DDAD012000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wduamdfi.cnv.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Local\Temp\IzyyQHg7CN.bat

MD5 5ee0b02eb5b6c4020742001dbb5d7564
SHA1 2ca045f2d3c8cfe8e1d65798d22defd7f2c47f60
SHA256 1e8aed5fc0b3cf1e5100748cc67354cb214073e65d91daad0ab74a0124078208
SHA512 dc4934cfe82a97328863a19372b592d1dfa250b5e0782cc5f0a039a7b80c1ce8cac0e85cfb17290957a6b4b639cd2e7434108cb9dd4c8495a57615939eccb4a9

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 62623d22bd9e037191765d5083ce16a3
SHA1 4a07da6872672f715a4780513d95ed8ddeefd259
SHA256 95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA512 9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 2979eabc783eaca50de7be23dd4eafcf
SHA1 d709ce5f3a06b7958a67e20870bfd95b83cad2ea
SHA256 006cca90e78fbb571532a83082ac6712721a34ea4b21f490058ffb3f521f4903
SHA512 92bc433990572d9427d0c93eef9bd1cc23fa00ed60dd0c9c983d87d3421e02ce3f156c6f88fe916ef6782dbf185cbce083bc0094f8c527f302be6a37d1c53aba

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 3a6bad9528f8e23fb5c77fbd81fa28e8
SHA1 f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256 986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512 846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 bd5940f08d0be56e65e5f2aaf47c538e
SHA1 d7e31b87866e5e383ab5499da64aba50f03e8443
SHA256 2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512 c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 6d3e9c29fe44e90aae6ed30ccf799ca8
SHA1 c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA256 2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA512 60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 2e907f77659a6601fcc408274894da2e
SHA1 9f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA256 385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
SHA512 34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 59d97011e091004eaffb9816aa0b9abd
SHA1 1602a56b01dd4b7c577ca27d3117e4bcc1aa657b
SHA256 18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
SHA512 d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

C:\Users\Admin\AppData\Local\Temp\0240b491-2552-41e3-93e6-ef2519354cad.vbs

MD5 e899f9c5a38c7d36142b69bc7240425e
SHA1 283581eaf94973971a1f5fe3a054f7f06fee943d
SHA256 340a150f66ff3fb8452d88742831f29bf271620f026177a1993fb1335a3d30d8
SHA512 01816c54eb8d1ab4c570f7b2b5d3874ea2c7ebb8c249350f69d022592eaa7bc2ad42e84d8fb0e68ba9f9f12418ff6e780c144d5791124a039e4f44a1a705f109

C:\Users\Admin\AppData\Local\Temp\24b7903e-e002-416e-863f-763042f48d1f.vbs

MD5 f936dcb17993614bd370eba21f97e6f3
SHA1 b44fd61ba3deb5e7a853693c538acab9e5770f91
SHA256 8682c25dcd14d8c964901e341bb0e10906bf7b74a91eab4b380d4ae284cc75e3
SHA512 0888526329549b9105a2141f8117bed9345f49d3a83327b9dd3be1f3734bcb1b61b5c451ae8bcf2dccdd73538b85c5b06bf7a845f6d3b66f0f193cc29aa33f08

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sihost.exe.log

MD5 49b64127208271d8f797256057d0b006
SHA1 b99bd7e2b4e9ed24de47fb3341ea67660b84cca1
SHA256 2a5d403a2e649d8eceef8f785eeb0f6d33888ec6bbf251b3c347e34cb32b1e77
SHA512 f7c728923c893dc9bc88ad2159e0abcda41e1b40ff7e7756e6252d135ed238a2248a2662b3392449836dd1b0b580f0c866cc33e409527484fe4602e3d3f10e3e

C:\Users\Admin\AppData\Local\Temp\da755566-76c3-4731-85b9-c6d0a726be21.vbs

MD5 fc64adf345b71e642474717ec054b12d
SHA1 46e545bee674147c9178e53e456e17d96ed5743b
SHA256 f811eae6a2e927cbc7b5d13cbe1c4b6c6a41ea163ee7b2b1cb24bead72111f54
SHA512 5ee5c1fa8d309860e7875dc585c0d89683582a26868c5e7706620d449f9a3eecb98df0caa352eda2d6920966829b10b7409985152b881dd5bd91d34a8503cb01

C:\Users\Admin\AppData\Local\Temp\e32f78e0-2192-420b-aea5-417d7416e695.vbs

MD5 90e6f7b0e8eb3c2123965d521b471644
SHA1 2eba442eb6d52715f1c7b55f9efc757eeb9b51a9
SHA256 9d6be7e948b319d8c65c965ddd356b891f621ca71fac35118ce79e841163c626
SHA512 3cbe678801288cf4cd328a947704900919a029442d714f120e585fa708b7af9edd00687212c9d420537cce637a2af985d6a5d0aa91b6627db9f51dc3bc3a8cba

C:\Users\Admin\AppData\Local\Temp\d34d6369-8f2b-4f8e-81cf-2d08541cb926.vbs

MD5 e1d2da85e82dcf2a8039db73501eb9c2
SHA1 9b6ce4a3ad580f17c07698902fa55b35b3147f28
SHA256 a7c7909310a78444c2d73e98b61bfd0262f39965c3035a79f422ead4effb3000
SHA512 4548fce522fa201444a34cd0110cfc3ceeccc4ef781b5fab1a98e3cd884f484a6923727a76fa28fabeb03555587611b6a24497d20b1b768738b78008c71d916e

C:\Users\Admin\AppData\Local\Temp\19869018-5556-4429-b7e5-ef1f95fd9969.vbs

MD5 12967a12c475943301010da5d29c3d27
SHA1 9ef8fb860276992a4715862abdad9f30b4792514
SHA256 e925b948ee7e3b5dbb7bb1112ca51cb531b9385aa9461269ee0849c2a2b39d3e
SHA512 6a4fe365d740faaea19fa57b9ab14364884bddc00277de643540b5d3af837cca8aad3bacad5f9b9b21f82f8206f83d7918c3392b4683c3d10c549a04e391f4d3

C:\Users\Admin\AppData\Local\Temp\98d4d29d-6ac1-4df1-9a17-5029024271a5.vbs

MD5 cfd328e60edea50a39de6c7995c28eca
SHA1 772a3424731eba9d7eb6846be4d57904bc58ee40
SHA256 176fbac9f78e994e45ff36c7bec018b8aab06b013dd22081ff9ea11d00968fd7
SHA512 faf67853fe0f67293dde12e0c30a9c7efc97ff0645cc0060da2b11c3d9e68c71cfe064329776c18b30f04cba6f7267cbb3edff0a2e4f47c30bce0d332955fbef