Malware Analysis Report

2024-11-13 13:43

Sample ID 240516-mal1asff9z
Target da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics
SHA256 a22fcf8eea502fd77a86507ef856f97512aeed2006a0d79f122850f5d14dcf9b
Tags
dcrat evasion execution infostealer rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a22fcf8eea502fd77a86507ef856f97512aeed2006a0d79f122850f5d14dcf9b

Threat Level: Known bad

The file da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics was found to be: Known bad.

Malicious Activity Summary

dcrat evasion execution infostealer rat trojan

DCRat payload

Dcrat family

UAC bypass

DcRat

Process spawned unexpected child process

DCRat payload

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Executes dropped EXE

Checks whether UAC is enabled

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

System policy modification

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Uses Task Scheduler COM API

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-16 10:15

Signatures

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Dcrat family

dcrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-16 10:15

Reported

2024-05-16 10:18

Platform

win7-20240508-en

Max time kernel

146s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe"

Signatures

DcRat

rat infostealer dcrat

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\dllhost.exe N/A

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\dllhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\dllhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\dllhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\dllhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\MSOCache\All Users\dllhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\MSOCache\All Users\dllhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\MSOCache\All Users\dllhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\MSOCache\All Users\dllhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\MSOCache\All Users\dllhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\MSOCache\All Users\dllhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\dllhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\MSOCache\All Users\dllhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\dllhost.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\7-Zip\Lang\RCX2E0B.tmp C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows NT\RCX393D.tmp C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\es-ES\RCX3B40.tmp C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\es-ES\RCX3BAF.tmp C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\es-ES\csrss.exe C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\wininit.exe C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Windows NT\886983d96e3d3e C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Windows NT\TableTextService\es-ES\886983d96e3d3e C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows NT\RCX393C.tmp C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows NT\csrss.exe C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\wininit.exe C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\csrss.exe C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\56085415360792 C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\RCX4A1B.tmp C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\RCX4A1C.tmp C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
File created C:\Program Files\7-Zip\Lang\886983d96e3d3e C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Windows NT\csrss.exe C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\RCX2E79.tmp C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
File created C:\Program Files\7-Zip\Lang\csrss.exe C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Windows NT\TableTextService\es-ES\csrss.exe C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Fonts\27d1bcfc3c54e0 C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Fonts\RCX32B0.tmp C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Fonts\RCX32B1.tmp C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Fonts\System.exe C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
File created C:\Windows\Fonts\System.exe C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\MSOCache\All Users\dllhost.exe N/A
N/A N/A C:\MSOCache\All Users\dllhost.exe N/A
N/A N/A C:\MSOCache\All Users\dllhost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\MSOCache\All Users\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\MSOCache\All Users\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\MSOCache\All Users\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\MSOCache\All Users\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\MSOCache\All Users\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\MSOCache\All Users\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\MSOCache\All Users\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\MSOCache\All Users\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\MSOCache\All Users\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\MSOCache\All Users\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\MSOCache\All Users\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\MSOCache\All Users\dllhost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1620 wrote to memory of 688 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1620 wrote to memory of 688 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1620 wrote to memory of 688 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1620 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1620 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1620 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1620 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1620 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1620 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1620 wrote to memory of 340 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1620 wrote to memory of 340 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1620 wrote to memory of 340 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1620 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1620 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1620 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1620 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1620 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1620 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1620 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1620 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1620 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1620 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1620 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1620 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1620 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1620 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1620 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1620 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1620 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1620 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1620 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1620 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1620 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1620 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1620 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1620 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1620 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\cmd.exe
PID 1620 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\cmd.exe
PID 1620 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\cmd.exe
PID 560 wrote to memory of 2660 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 560 wrote to memory of 2660 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 560 wrote to memory of 2660 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 560 wrote to memory of 1260 N/A C:\Windows\System32\cmd.exe C:\MSOCache\All Users\dllhost.exe
PID 560 wrote to memory of 1260 N/A C:\Windows\System32\cmd.exe C:\MSOCache\All Users\dllhost.exe
PID 560 wrote to memory of 1260 N/A C:\Windows\System32\cmd.exe C:\MSOCache\All Users\dllhost.exe
PID 1260 wrote to memory of 2904 N/A C:\MSOCache\All Users\dllhost.exe C:\Windows\System32\WScript.exe
PID 1260 wrote to memory of 2904 N/A C:\MSOCache\All Users\dllhost.exe C:\Windows\System32\WScript.exe
PID 1260 wrote to memory of 2904 N/A C:\MSOCache\All Users\dllhost.exe C:\Windows\System32\WScript.exe
PID 1260 wrote to memory of 2180 N/A C:\MSOCache\All Users\dllhost.exe C:\Windows\System32\WScript.exe
PID 1260 wrote to memory of 2180 N/A C:\MSOCache\All Users\dllhost.exe C:\Windows\System32\WScript.exe
PID 1260 wrote to memory of 2180 N/A C:\MSOCache\All Users\dllhost.exe C:\Windows\System32\WScript.exe
PID 2904 wrote to memory of 992 N/A C:\Windows\System32\WScript.exe C:\MSOCache\All Users\dllhost.exe
PID 2904 wrote to memory of 992 N/A C:\Windows\System32\WScript.exe C:\MSOCache\All Users\dllhost.exe
PID 2904 wrote to memory of 992 N/A C:\Windows\System32\WScript.exe C:\MSOCache\All Users\dllhost.exe
PID 992 wrote to memory of 1872 N/A C:\MSOCache\All Users\dllhost.exe C:\Windows\System32\WScript.exe
PID 992 wrote to memory of 1872 N/A C:\MSOCache\All Users\dllhost.exe C:\Windows\System32\WScript.exe
PID 992 wrote to memory of 1872 N/A C:\MSOCache\All Users\dllhost.exe C:\Windows\System32\WScript.exe
PID 992 wrote to memory of 536 N/A C:\MSOCache\All Users\dllhost.exe C:\Windows\System32\WScript.exe
PID 992 wrote to memory of 536 N/A C:\MSOCache\All Users\dllhost.exe C:\Windows\System32\WScript.exe
PID 992 wrote to memory of 536 N/A C:\MSOCache\All Users\dllhost.exe C:\Windows\System32\WScript.exe
PID 1872 wrote to memory of 1812 N/A C:\Windows\System32\WScript.exe C:\MSOCache\All Users\dllhost.exe
PID 1872 wrote to memory of 1812 N/A C:\Windows\System32\WScript.exe C:\MSOCache\All Users\dllhost.exe
PID 1872 wrote to memory of 1812 N/A C:\Windows\System32\WScript.exe C:\MSOCache\All Users\dllhost.exe
PID 1812 wrote to memory of 2160 N/A C:\MSOCache\All Users\dllhost.exe C:\Windows\System32\WScript.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\MSOCache\All Users\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\MSOCache\All Users\dllhost.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsml" /sc MINUTE /mo 14 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\lsm.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\lsm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsml" /sc MINUTE /mo 13 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\lsm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "da302f8b90f36acd84743c7639d4e0d0_NeikiAnalyticsd" /sc MINUTE /mo 5 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics" /sc ONLOGON /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "da302f8b90f36acd84743c7639d4e0d0_NeikiAnalyticsd" /sc MINUTE /mo 13 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Saved Games\audiodg.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Users\Admin\Saved Games\audiodg.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Saved Games\audiodg.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files\7-Zip\Lang\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files\7-Zip\Lang\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\lsass.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\lsass.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\lsass.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Windows\Fonts\System.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\Fonts\System.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Windows\Fonts\System.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\explorer.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\taskhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Users\Default User\taskhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\taskhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows NT\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows NT\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\es-ES\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\es-ES\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\es-ES\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\dllhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Adobe\Updater6\lsass.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\All Users\Adobe\Updater6\lsass.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Adobe\Updater6\lsass.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\spoolsv.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Music\audiodg.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Users\Default\Music\audiodg.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Music\audiodg.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Microsoft Help\lsass.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft Help\lsass.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Microsoft Help\lsass.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Reader\wininit.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Reader\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Reader\wininit.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\975DOJvBwA.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\MSOCache\All Users\dllhost.exe

"C:\MSOCache\All Users\dllhost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3e2015e1-9de3-40d9-9498-5d86330c1ffe.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9995948e-2435-48e8-9432-61a8c13d89f3.vbs"

C:\MSOCache\All Users\dllhost.exe

"C:\MSOCache\All Users\dllhost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\44147dcb-cc2f-494a-bff0-d297e8ab25e0.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fd685df6-6b82-45f0-94f0-cf05269c4931.vbs"

C:\MSOCache\All Users\dllhost.exe

"C:\MSOCache\All Users\dllhost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d9d29ded-b1be-4ae0-bd66-9934a6581e61.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3eeb865e-d19e-4d63-b214-22ec8dd9b50d.vbs"

C:\MSOCache\All Users\dllhost.exe

"C:\MSOCache\All Users\dllhost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ff2f51e7-6311-4120-8bb4-8f30828e7a97.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b0993398-6304-4cdf-8a68-72091d68a8fd.vbs"

C:\MSOCache\All Users\dllhost.exe

"C:\MSOCache\All Users\dllhost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6c327601-3250-4502-8e78-7786749bbcb7.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0beb8ac1-dd4c-4efe-9683-8cff200e0ee5.vbs"

C:\MSOCache\All Users\dllhost.exe

"C:\MSOCache\All Users\dllhost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e2ce8f7a-d2ab-43af-a77d-8256a62ab62a.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\60a0e82b-7917-479f-9d33-1bbebd8d23ae.vbs"

C:\MSOCache\All Users\dllhost.exe

"C:\MSOCache\All Users\dllhost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\731d4967-d31e-4e8c-b242-92bb7dbca494.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\78583bdd-3533-4700-adbd-674fdea49726.vbs"

C:\MSOCache\All Users\dllhost.exe

"C:\MSOCache\All Users\dllhost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7104dc35-1082-4716-b98f-7e4dff457c03.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3a5c7089-e6e0-4386-a2fc-61c1135d123c.vbs"

C:\MSOCache\All Users\dllhost.exe

"C:\MSOCache\All Users\dllhost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\77b8499b-8f07-4007-bea7-7851fdfa0d67.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c648ebf5-09dc-4422-81c0-4755c483dc88.vbs"

C:\MSOCache\All Users\dllhost.exe

"C:\MSOCache\All Users\dllhost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6b657a66-38ba-4374-a469-85bc2c251b46.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a457c264-2664-4c57-a35e-49a08c13bb81.vbs"

C:\MSOCache\All Users\dllhost.exe

"C:\MSOCache\All Users\dllhost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bba88df0-dab3-4108-aa84-9b58efd0ae1b.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\80184ac8-f4b9-4973-abf2-e7ff331e66e7.vbs"

C:\MSOCache\All Users\dllhost.exe

"C:\MSOCache\All Users\dllhost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5239759f-5e77-4774-9bf0-9fe579501fcd.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\53446691-205b-4738-8a61-40ebb282f6b4.vbs"

Network

Country Destination Domain Proto
US 8.8.8.8:53 self-lighting-subpr.000webhostapp.com udp
US 145.14.145.49:80 self-lighting-subpr.000webhostapp.com tcp
US 145.14.145.49:80 self-lighting-subpr.000webhostapp.com tcp
US 145.14.145.49:80 self-lighting-subpr.000webhostapp.com tcp
US 145.14.145.49:80 self-lighting-subpr.000webhostapp.com tcp
US 145.14.145.49:80 self-lighting-subpr.000webhostapp.com tcp
US 145.14.145.49:80 self-lighting-subpr.000webhostapp.com tcp
US 8.8.8.8:53 self-lighting-subpr.000webhostapp.com udp
US 145.14.145.30:80 self-lighting-subpr.000webhostapp.com tcp
US 145.14.145.30:80 self-lighting-subpr.000webhostapp.com tcp
US 145.14.145.30:80 self-lighting-subpr.000webhostapp.com tcp
US 145.14.145.30:80 self-lighting-subpr.000webhostapp.com tcp
US 145.14.145.30:80 self-lighting-subpr.000webhostapp.com tcp
US 8.8.8.8:53 self-lighting-subpr.000webhostapp.com udp
US 145.14.145.217:80 self-lighting-subpr.000webhostapp.com tcp

Files

memory/1620-0-0x000007FEF5323000-0x000007FEF5324000-memory.dmp

memory/1620-1-0x00000000012F0000-0x000000000162C000-memory.dmp

memory/1620-2-0x000007FEF5320000-0x000007FEF5D0C000-memory.dmp

memory/1620-3-0x0000000000980000-0x000000000098E000-memory.dmp

memory/1620-4-0x0000000000990000-0x000000000099E000-memory.dmp

memory/1620-5-0x0000000000A20000-0x0000000000A28000-memory.dmp

memory/1620-6-0x0000000001260000-0x000000000127C000-memory.dmp

memory/1620-7-0x0000000000DD0000-0x0000000000DD8000-memory.dmp

memory/1620-8-0x0000000001280000-0x0000000001290000-memory.dmp

memory/1620-9-0x0000000001290000-0x00000000012A6000-memory.dmp

memory/1620-10-0x00000000012B0000-0x00000000012B8000-memory.dmp

memory/1620-11-0x00000000012D0000-0x00000000012E0000-memory.dmp

memory/1620-12-0x00000000012C0000-0x00000000012CA000-memory.dmp

memory/1620-13-0x000000001AA30000-0x000000001AA86000-memory.dmp

memory/1620-14-0x00000000012E0000-0x00000000012EC000-memory.dmp

memory/1620-15-0x000000001AA80000-0x000000001AA88000-memory.dmp

memory/1620-16-0x000000001AA90000-0x000000001AA9C000-memory.dmp

memory/1620-17-0x000000001AAA0000-0x000000001AAA8000-memory.dmp

memory/1620-18-0x000000001AE80000-0x000000001AE92000-memory.dmp

memory/1620-19-0x000000001AEB0000-0x000000001AEBC000-memory.dmp

memory/1620-20-0x000000001AEC0000-0x000000001AECC000-memory.dmp

memory/1620-21-0x000000001AED0000-0x000000001AEDC000-memory.dmp

memory/1620-22-0x000000001AEE0000-0x000000001AEEC000-memory.dmp

memory/1620-23-0x000000001AEF0000-0x000000001AEF8000-memory.dmp

memory/1620-24-0x000000001AF00000-0x000000001AF0A000-memory.dmp

memory/1620-25-0x000000001AF10000-0x000000001AF1E000-memory.dmp

memory/1620-27-0x000000001AF30000-0x000000001AF3E000-memory.dmp

memory/1620-26-0x000000001AF20000-0x000000001AF28000-memory.dmp

memory/1620-28-0x000000001AFC0000-0x000000001AFCC000-memory.dmp

memory/1620-29-0x000000001AFD0000-0x000000001AFD8000-memory.dmp

memory/1620-30-0x000000001AFE0000-0x000000001AFEA000-memory.dmp

memory/1620-31-0x000000001AFF0000-0x000000001AFFC000-memory.dmp

memory/1620-32-0x000007FEF5320000-0x000007FEF5D0C000-memory.dmp

C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\lsass.exe

MD5 da302f8b90f36acd84743c7639d4e0d0
SHA1 f8fdb617872a6f31fc21b7d7826efba0651077a4
SHA256 a22fcf8eea502fd77a86507ef856f97512aeed2006a0d79f122850f5d14dcf9b
SHA512 cb2392bfd6277ba436ccf0421baccbae4f2b6ef2ecbcd2c72c95de2e3a820a212cd9c7d3662795290341d9c285e75a8a2111fda8bb1ec296a9772689a9af9646

C:\Program Files\7-Zip\Lang\csrss.exe

MD5 8df05a7afeb24bfed11bdb7b8ee9d835
SHA1 c9b79f99f256ace051d271cb9f7ae318a97f0e8e
SHA256 64f8f1e12627588718136a1fc129060de5ba18670ca0528d2994d9fdd2fc9e01
SHA512 176c0f696d7994d4c5cb5971157aeaa0881420811bbc58654bcc1e6ee9b5b4435080752672f6f4f3cd7f10d6c1fc5d679fbe6a3c85784dd65aa2ad1c73b3fd23

C:\Program Files (x86)\Windows NT\TableTextService\es-ES\csrss.exe

MD5 6027e1528af2f4aed482e4edd058f1d0
SHA1 809db11e8b38db7a283ffd284d88b25f2ef32209
SHA256 695cc40b67b0ea5c6a4c9e9fb432beffbd8ae8a32cc922235e60e4c19271a296
SHA512 60cbbd68fa220a067252fdca36c7ad96f00fda8676c4432d2bff5a5df686a4f757c5094bbaf0b25c8686eda366af2a7a0c6c67c1ba13cf3cee90acd58fe7e536

C:\MSOCache\All Users\dllhost.exe

MD5 b528a71c2481671646f860dc135a024d
SHA1 4cb24f495e7dce7bcae557aa4913d4195c53f63a
SHA256 748ed4d86d6bcb4b227dbf7ecb7ace18c2e6b7c908606f66be3381d6ea52c4b5
SHA512 2bfc97bd9ba092b7378908ed4bb7811c679d5503f92e7a98657717edc14a95611f0145d3e0786de625f3d7fb8ab0247070ffce4261e0694b2abb40385f40572a

C:\ProgramData\Adobe\Updater6\lsass.exe

MD5 abd23823f040833e541d2388d92643be
SHA1 0bddfd22e71d8b700815123d3596d0922f5a55cd
SHA256 b5914f66fa2ba100d6b53e5e8dacd7f7b604ee3cf1719b2f81a43e874fbac7ef
SHA512 060745e473acd01759b7329d2a7a737272bb9c827d29e15c2fd952267ed84576c90a7a5a4f5519c7828a392ffe570aba3b10cc9633343319ae57f988afc81e8b

C:\Users\Default\Music\RCX4586.tmp

MD5 8a769600a2f9fca385bbc608fac9ce5c
SHA1 7cb96efa050b4ce4069e59368207448308960fa4
SHA256 7fcc94712003093d6350e47b0b4cdb2703b281eacfb9222ec588483caeef6c2f
SHA512 c40ec8a56de495451e0b3d9a481bbbed093fa4fa15dfa8664f26ab6403c8b6389883e7f4d26ff31ba48a665c2580a5a15d716a6016f195a64d1043769d391a9f

C:\ProgramData\Microsoft Help\lsass.exe

MD5 1b0cd3fdaee291313ed947fedc264c02
SHA1 c32b5afdf5e2dfa594cb18a9de7855076e202cbb
SHA256 ed4ed2267d6e48b2f3d1127a258c6fb8566824a93b241586bc65b6a0f25cad7c
SHA512 537264646a50262cf0cef79941673ef5beee260e98a1d2a200604f9aa8936dbdc4b195f923d1a049e33735f0c71313b778daad926383904424d8467f18f5cb8f

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 f1668cae22f749bf0ad19f25479f0569
SHA1 958111a610c26f39fb0af8aadb07962d8ac9c6c1
SHA256 68bd4da53a2c45d2587cc562c5c300e322b0577ada05844624c2d168efdf8cfc
SHA512 a183f5a4a05528e57989421a932cc1e719084bd521867f1a0897c3d6d36045c373694caad1b6518ede37c838d4482b292dca9ceed41f242d883c3fce2c10edea

memory/1620-268-0x000007FEF5320000-0x000007FEF5D0C000-memory.dmp

memory/2860-280-0x0000000002850000-0x0000000002858000-memory.dmp

memory/2860-279-0x000000001B5E0000-0x000000001B8C2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\975DOJvBwA.bat

MD5 cb504a7e7f6623c5e851387d470ba840
SHA1 c36ad8b77b05da771eb8c1aa3dd83d9353e1e628
SHA256 650bfba7cc8044cd48bb463f833ecf7ea2040fa25deb594e5af3d52cb5fac204
SHA512 1db39a55e075489c375fba836f3bcd426a7ccb4d9a20a375b54e12e7783a1db66a24a83da148348640208dc970752fbd0e4a453155fc23122167f25dccf66d31

memory/1260-322-0x0000000000E60000-0x000000000119C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3e2015e1-9de3-40d9-9498-5d86330c1ffe.vbs

MD5 6fa848df25aa5fa0c527713c570829f6
SHA1 94e8a0815da30796a421e965a32d335330b4570f
SHA256 9f05a5224a195a89ac803d85dd7f553d5aec45a26e4275612f19e68b93a958a3
SHA512 54e6fceec03681fae00197b8b5278f20aeaeb50db7a4dccb183fee2b57941142ed7d57000981c360ae70c6eaca80f5d6697e18b7a03e505b2fdba21773153d2a

C:\Users\Admin\AppData\Local\Temp\9995948e-2435-48e8-9432-61a8c13d89f3.vbs

MD5 6bebb880bc70b375b28d1267815307fc
SHA1 2c03243d17a8c15423c80cfd4941f5020a232f86
SHA256 85c395ace4aa90777846f8921c72ee2cd747b68ce2a7a32061d8dc77c67d28a9
SHA512 db016ca7c535b89e58135061fab52e957ef75ec4ce31575980a8ddb74a3b82eacc9bc30d03b9778473937123c1d55400da1e79c37848c99a2307de772000a743

memory/992-333-0x00000000010A0000-0x00000000013DC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\44147dcb-cc2f-494a-bff0-d297e8ab25e0.vbs

MD5 9a80baf0c7948520c1ce3d9759413ebc
SHA1 792dfbead5ceb1aa8c88d6b1cf96e4d37b279afe
SHA256 1c6222f5efcbf7d3488f266e997770e3e0a13a8527b8fa68e1f4e9e8e784e6fb
SHA512 b1c823d7a5a5bd8cbbb08179a6693bba277c4ecc90058f08eefa35a65ff7c62b15ad71fe01a29d5bc55267f21d37b5f1074a9693f1274808246dda7b0b8ebdeb

memory/1812-345-0x0000000001260000-0x000000000159C000-memory.dmp

memory/1812-346-0x0000000000BF0000-0x0000000000C02000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\d9d29ded-b1be-4ae0-bd66-9934a6581e61.vbs

MD5 1cce540aa564efff482e0b7bb0e9416a
SHA1 743718d05ffa086740305046c24cc383890c7ffd
SHA256 34f00fe6ed3154a7b1f933c8247454ffa93fc43e980b7dcf18b03141ffabba6e
SHA512 080cfbce3aab9aac447d7e93c30f249b0b0d109eb4ba0da52b677b2bd5abe08a3e9dc363100d0b545d0221c098cf3c5d0c35a57375bda34fc94b36a31eb8d57b

C:\Users\Admin\AppData\Local\Temp\ff2f51e7-6311-4120-8bb4-8f30828e7a97.vbs

MD5 39f13f67821e107c5bb7439016a24bfb
SHA1 27e07b96d179c81602e738d06b93a31ad9711ac2
SHA256 360f2c3d836e9c82e4aebd95fd1490407688b829a28739efc1c7b2a42742d50f
SHA512 06d7ad462a20602fbbfbd55e78f04c2e32bd32ec94307e65b08b9eb8f1a34b9f1b769ceabe94eee2c060f888648b70ae636fafacbbba971baf27bbe1ef404796

memory/1280-369-0x00000000002C0000-0x00000000005FC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6c327601-3250-4502-8e78-7786749bbcb7.vbs

MD5 34010b0d25249015693f72e88a82fd48
SHA1 6810b28d142e96b22b9bc2628ee43a6dd8d56abb
SHA256 2ff3d5539223f7fe9ce71f4de841393f321f5902beb3249ae8c8dd154f2d1a6e
SHA512 54d878f6bf44b216438bf74bb0387229c165a210139880739a49b5c7cd87847a39645b0f9724dbc1c94514f099d18a52c824a0da465386da5ac0f4e38df15d1a

memory/2480-381-0x00000000011B0000-0x00000000014EC000-memory.dmp

memory/2480-382-0x0000000000C20000-0x0000000000C76000-memory.dmp

memory/2480-383-0x00000000006D0000-0x00000000006E2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\e2ce8f7a-d2ab-43af-a77d-8256a62ab62a.vbs

MD5 296b5566df2f295ab2228eac2c8718c0
SHA1 cf515aeccc1f0dd0d8ff1c580d5079259e0d17cf
SHA256 eb6ffb4ce993b12f5d20d67923e1abc7de4daa188a687e67140cb87d9316ec1a
SHA512 d568346a1eecb51cef06dea705607714bba5e73d851073a821f3f77bfae867ad829f3a398b4c49277636a3519e29d205f749048c1931454e6d63e1718e1b134e

C:\Users\Admin\AppData\Local\Temp\731d4967-d31e-4e8c-b242-92bb7dbca494.vbs

MD5 c8f230ade386ac9781daafe8826e8483
SHA1 901607a8a106006771517728318e9ebddfb35aba
SHA256 554cf0a3c31460b65eb085369659f341f3d51b7882b988a0a311322938158405
SHA512 41154b1bba1dab378841e8683a6b033493947420594b59f126d538e9619cf7d282e56c6b0c27dbb5efd3ff4bb0820140422bfa77aab3a0b644d9c78ba01b2e7d

memory/1676-406-0x0000000000080000-0x00000000003BC000-memory.dmp

memory/1676-407-0x0000000000890000-0x00000000008E6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7104dc35-1082-4716-b98f-7e4dff457c03.vbs

MD5 4b308412cc615a1467d436dd87f36dc2
SHA1 7ed2611357f54dcdde32407ceb5da1763fb83de0
SHA256 d89509da03abb6b03c87ae00109ac25a73de58ba80bb5a96410caa4ac6c84a76
SHA512 f3009ae8772ac58fb8ff4368c4bd2ccba266c2afe76bd9353edabefd99769c617435a7c47939adf866d0463f601da0c1e10604ed454a884ee47c7dec1c5e8ed9

memory/2764-419-0x0000000000250000-0x000000000058C000-memory.dmp

memory/2764-420-0x00000000022D0000-0x00000000022E2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\77b8499b-8f07-4007-bea7-7851fdfa0d67.vbs

MD5 6e44c75178e5170640666480dc857337
SHA1 b06501084da1b7afde1d069e2eb73bf60f8d9d93
SHA256 fd30b7d9c58f3784b646e5e3d66c1cece7f1cc933a771b943c44574adc5ffa69
SHA512 66617ff6fb015d54a55f00a15ffcb06520194d7bc45fd68f17b747aec910cd16b5b8b12560f13100b7c047f140eb017dbe7e79ebe8943e70974044c5d5216cdf

memory/2936-432-0x00000000000C0000-0x00000000003FC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6b657a66-38ba-4374-a469-85bc2c251b46.vbs

MD5 539f0e1906b9ab4b4806ee993df8fb40
SHA1 0f7299c8b54361c24e6dfecadf31af76d75a32f0
SHA256 997ce0b447e876370107e3c56fed7180864e0cc408a49429338ac3ac0e962f35
SHA512 05c295c5766ae341cf49f03734c037f5bb4c40ce8290ba08fd411e271a8b6ccebb5b39d94736f69c8cc85c91f8dbe0926ae88bc6ecdb758df9d54bc34c2273ce

memory/2760-444-0x0000000000B90000-0x0000000000ECC000-memory.dmp

memory/2760-445-0x0000000002310000-0x0000000002366000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\bba88df0-dab3-4108-aa84-9b58efd0ae1b.vbs

MD5 b0fd80aa93075a62a815e5ae0ef4ed69
SHA1 2e8703ec3dc9fa169da6c2ac87d8a01b6dd1c45b
SHA256 c64ffbdf0946cb4e0a46063c29b5e79a67e69829044d7d72f8b31c9258b813d9
SHA512 8aa0dbceba11eaba5c2903a35b1cec84ff1fc058fc1d7877627d1352f60b74cc231afd99503a445199077d18021bc1667d9658480c348160324db101d9a8b730

memory/2268-457-0x0000000000EA0000-0x00000000011DC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5239759f-5e77-4774-9bf0-9fe579501fcd.vbs

MD5 ea6d199cb3b78accf256018571cc6d33
SHA1 832cc1113e6074151147cb6cf3caec8ca26f5878
SHA256 4c50e37553760fdde86e45493e77b922807cb69b62aed1f9c78a8f6a5b40e391
SHA512 7d5999e850fd65be2a552ba2f54314c1baedcaa3bc8da0269b3231311630358200814a4d56a521370ff4c6f2fe7e70e6892342824fecd539085bdaee4c4d2450

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-16 10:15

Reported

2024-05-16 10:18

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe"

Signatures

DcRat

rat infostealer dcrat

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Windows Portable Devices\RCX43D6.tmp C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
File created C:\Program Files\Windows Portable Devices\sysmon.exe C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Google\CrashReports\RCX3F2E.tmp C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Google\CrashReports\RCX3F2F.tmp C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Windows Portable Devices\RCX43C6.tmp C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Windows Portable Devices\sysmon.exe C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Google\CrashReports\sihost.exe C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Google\CrashReports\sihost.exe C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Google\CrashReports\66fc9ff0ee96c2 C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
File created C:\Program Files\Windows Portable Devices\121e5b5079f7c0 C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\ServiceState\EventLog\dllhost.exe C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
N/A N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
N/A N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
N/A N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
N/A N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
N/A N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
N/A N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
N/A N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
N/A N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
N/A N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
N/A N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
N/A N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
N/A N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
N/A N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
N/A N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3448 wrote to memory of 404 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3448 wrote to memory of 404 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3448 wrote to memory of 440 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3448 wrote to memory of 440 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3448 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3448 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3448 wrote to memory of 3164 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3448 wrote to memory of 3164 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3448 wrote to memory of 1596 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3448 wrote to memory of 1596 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3448 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3448 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3448 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3448 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3448 wrote to memory of 3356 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3448 wrote to memory of 3356 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3448 wrote to memory of 3988 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3448 wrote to memory of 3988 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3448 wrote to memory of 3996 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3448 wrote to memory of 3996 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3448 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3448 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3448 wrote to memory of 3872 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Program Files (x86)\Google\CrashReports\sihost.exe
PID 3448 wrote to memory of 3872 N/A C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe C:\Program Files (x86)\Google\CrashReports\sihost.exe
PID 3872 wrote to memory of 4504 N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe C:\Windows\System32\WScript.exe
PID 3872 wrote to memory of 4504 N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe C:\Windows\System32\WScript.exe
PID 3872 wrote to memory of 1304 N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe C:\Windows\System32\WScript.exe
PID 3872 wrote to memory of 1304 N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe C:\Windows\System32\WScript.exe
PID 4504 wrote to memory of 2572 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Google\CrashReports\sihost.exe
PID 4504 wrote to memory of 2572 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Google\CrashReports\sihost.exe
PID 2572 wrote to memory of 2712 N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe C:\Windows\System32\WScript.exe
PID 2572 wrote to memory of 2712 N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe C:\Windows\System32\WScript.exe
PID 2572 wrote to memory of 2620 N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe C:\Windows\System32\WScript.exe
PID 2572 wrote to memory of 2620 N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe C:\Windows\System32\WScript.exe
PID 2712 wrote to memory of 2964 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Google\CrashReports\sihost.exe
PID 2712 wrote to memory of 2964 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Google\CrashReports\sihost.exe
PID 2964 wrote to memory of 4556 N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe C:\Windows\System32\WScript.exe
PID 2964 wrote to memory of 4556 N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe C:\Windows\System32\WScript.exe
PID 2964 wrote to memory of 2688 N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe C:\Windows\System32\WScript.exe
PID 2964 wrote to memory of 2688 N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe C:\Windows\System32\WScript.exe
PID 4556 wrote to memory of 3704 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Google\CrashReports\sihost.exe
PID 4556 wrote to memory of 3704 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Google\CrashReports\sihost.exe
PID 3704 wrote to memory of 4976 N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe C:\Windows\System32\WScript.exe
PID 3704 wrote to memory of 4976 N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe C:\Windows\System32\WScript.exe
PID 3704 wrote to memory of 4244 N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe C:\Windows\System32\WScript.exe
PID 3704 wrote to memory of 4244 N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe C:\Windows\System32\WScript.exe
PID 4976 wrote to memory of 4364 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Google\CrashReports\sihost.exe
PID 4976 wrote to memory of 4364 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Google\CrashReports\sihost.exe
PID 4364 wrote to memory of 2960 N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe C:\Windows\System32\WScript.exe
PID 4364 wrote to memory of 2960 N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe C:\Windows\System32\WScript.exe
PID 4364 wrote to memory of 1472 N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe C:\Windows\System32\WScript.exe
PID 4364 wrote to memory of 1472 N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe C:\Windows\System32\WScript.exe
PID 2960 wrote to memory of 4816 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Google\CrashReports\sihost.exe
PID 2960 wrote to memory of 4816 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Google\CrashReports\sihost.exe
PID 4816 wrote to memory of 1824 N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe C:\Windows\System32\WScript.exe
PID 4816 wrote to memory of 1824 N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe C:\Windows\System32\WScript.exe
PID 4816 wrote to memory of 412 N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe C:\Windows\System32\WScript.exe
PID 4816 wrote to memory of 412 N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe C:\Windows\System32\WScript.exe
PID 1824 wrote to memory of 2712 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Google\CrashReports\sihost.exe
PID 1824 wrote to memory of 2712 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Google\CrashReports\sihost.exe
PID 2712 wrote to memory of 3956 N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe C:\Windows\System32\WScript.exe
PID 2712 wrote to memory of 3956 N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe C:\Windows\System32\WScript.exe
PID 2712 wrote to memory of 3376 N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe C:\Windows\System32\WScript.exe
PID 2712 wrote to memory of 3376 N/A C:\Program Files (x86)\Google\CrashReports\sihost.exe C:\Windows\System32\WScript.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Google\CrashReports\sihost.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\da302f8b90f36acd84743c7639d4e0d0_NeikiAnalytics.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Google\CrashReports\sihost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\CrashReports\sihost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Google\CrashReports\sihost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Portable Devices\sysmon.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\sysmon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Portable Devices\sysmon.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'

C:\Program Files (x86)\Google\CrashReports\sihost.exe

"C:\Program Files (x86)\Google\CrashReports\sihost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e7af6a02-58e4-4c8d-a720-65e599626d92.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b22a7699-96b5-47f4-8637-65af61b2ca52.vbs"

C:\Program Files (x86)\Google\CrashReports\sihost.exe

"C:\Program Files (x86)\Google\CrashReports\sihost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\923d7220-d44c-4527-b8af-9bec626431dd.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b643d122-2568-4101-87c5-c62fa75ba29d.vbs"

C:\Program Files (x86)\Google\CrashReports\sihost.exe

"C:\Program Files (x86)\Google\CrashReports\sihost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b80c72ab-4b1a-4370-8ac7-2aa9390d9ef9.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fbe47695-9c83-40c6-a4c6-0a74d5f55c72.vbs"

C:\Program Files (x86)\Google\CrashReports\sihost.exe

"C:\Program Files (x86)\Google\CrashReports\sihost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\af7c36c7-0295-4088-8a3a-9abf35df05cc.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dc8b3093-06bc-4259-ba57-42a9ccaba795.vbs"

C:\Program Files (x86)\Google\CrashReports\sihost.exe

"C:\Program Files (x86)\Google\CrashReports\sihost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\be561dfa-dc37-4c79-a52e-90a82faa7c02.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5cac550f-7fde-43df-bbeb-65f08654c20a.vbs"

C:\Program Files (x86)\Google\CrashReports\sihost.exe

"C:\Program Files (x86)\Google\CrashReports\sihost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\97ef5c2c-3241-42e7-97fc-c81ec8f5b01d.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c2897efd-f0a0-4dba-a774-9eca2b6bec52.vbs"

C:\Program Files (x86)\Google\CrashReports\sihost.exe

"C:\Program Files (x86)\Google\CrashReports\sihost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1725a334-0402-44a7-a381-3f331601735e.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7ed68d7c-45f3-4ed9-add7-1fd798cee6ae.vbs"

C:\Program Files (x86)\Google\CrashReports\sihost.exe

"C:\Program Files (x86)\Google\CrashReports\sihost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cfe0eb68-6f62-4a52-8054-7ab417839e89.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\df18b71e-a292-49e9-909e-4400cedf77b7.vbs"

C:\Program Files (x86)\Google\CrashReports\sihost.exe

"C:\Program Files (x86)\Google\CrashReports\sihost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2e80ad66-59ff-4bea-9db4-0df85139ac48.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\97b626d8-36e2-41d1-8393-ebc5f55a4c33.vbs"

C:\Program Files (x86)\Google\CrashReports\sihost.exe

"C:\Program Files (x86)\Google\CrashReports\sihost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\da35f0d7-f744-4562-a3e7-95625eff0de8.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9f27b5bc-324e-418e-8fd0-cce37563700f.vbs"

C:\Program Files (x86)\Google\CrashReports\sihost.exe

"C:\Program Files (x86)\Google\CrashReports\sihost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1063dee0-da0a-43df-afc1-c6d3b34943dc.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\587f3d2c-df7d-4031-933b-787aafc80eeb.vbs"

C:\Program Files (x86)\Google\CrashReports\sihost.exe

"C:\Program Files (x86)\Google\CrashReports\sihost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\96434b13-5af3-4a61-96f0-9848579e0e38.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\01aabcbe-237e-4787-93f2-f99301fdd236.vbs"

C:\Program Files (x86)\Google\CrashReports\sihost.exe

"C:\Program Files (x86)\Google\CrashReports\sihost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\04adecc0-68c2-44b6-b994-64c5fd4d8088.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7260584f-1f2c-4d7c-98ec-95dea2df4563.vbs"

C:\Program Files (x86)\Google\CrashReports\sihost.exe

"C:\Program Files (x86)\Google\CrashReports\sihost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a75ae236-55db-445b-82e4-0d99ddc34265.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\35c7e295-388c-4eab-935a-ca5bb78c4586.vbs"

C:\Program Files (x86)\Google\CrashReports\sihost.exe

"C:\Program Files (x86)\Google\CrashReports\sihost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.154:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 154.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
NL 23.62.61.154:443 www.bing.com tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 self-lighting-subpr.000webhostapp.com udp
US 145.14.145.70:80 self-lighting-subpr.000webhostapp.com tcp
US 8.8.8.8:53 70.145.14.145.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 145.14.145.70:80 self-lighting-subpr.000webhostapp.com tcp
US 145.14.145.70:80 self-lighting-subpr.000webhostapp.com tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 142.53.16.96.in-addr.arpa udp
US 145.14.145.70:80 self-lighting-subpr.000webhostapp.com tcp
US 145.14.145.70:80 self-lighting-subpr.000webhostapp.com tcp
US 145.14.145.70:80 self-lighting-subpr.000webhostapp.com tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 self-lighting-subpr.000webhostapp.com udp
US 145.14.145.30:80 self-lighting-subpr.000webhostapp.com tcp
US 8.8.8.8:53 30.145.14.145.in-addr.arpa udp
US 145.14.145.30:80 self-lighting-subpr.000webhostapp.com tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 145.14.145.30:80 self-lighting-subpr.000webhostapp.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 145.14.145.30:80 self-lighting-subpr.000webhostapp.com tcp
US 145.14.145.30:80 self-lighting-subpr.000webhostapp.com tcp
US 145.14.145.30:80 self-lighting-subpr.000webhostapp.com tcp
US 145.14.145.30:80 self-lighting-subpr.000webhostapp.com tcp
US 8.8.8.8:53 self-lighting-subpr.000webhostapp.com udp
US 145.14.144.230:80 self-lighting-subpr.000webhostapp.com tcp
US 8.8.8.8:53 230.144.14.145.in-addr.arpa udp
US 8.8.8.8:53 udp

Files

memory/3448-0-0x00007FF9A0683000-0x00007FF9A0685000-memory.dmp

memory/3448-1-0x00000000002E0000-0x000000000061C000-memory.dmp

memory/3448-2-0x00007FF9A0680000-0x00007FF9A1141000-memory.dmp

memory/3448-3-0x0000000000DF0000-0x0000000000DFE000-memory.dmp

memory/3448-4-0x000000001B120000-0x000000001B12E000-memory.dmp

memory/3448-6-0x000000001B140000-0x000000001B15C000-memory.dmp

memory/3448-5-0x000000001B130000-0x000000001B138000-memory.dmp

memory/3448-9-0x000000001B170000-0x000000001B180000-memory.dmp

memory/3448-10-0x000000001B180000-0x000000001B196000-memory.dmp

memory/3448-8-0x000000001B160000-0x000000001B168000-memory.dmp

memory/3448-12-0x000000001B1D0000-0x000000001B1E0000-memory.dmp

memory/3448-11-0x000000001B1B0000-0x000000001B1B8000-memory.dmp

memory/3448-7-0x000000001B200000-0x000000001B250000-memory.dmp

memory/3448-13-0x000000001B1C0000-0x000000001B1CA000-memory.dmp

memory/3448-14-0x000000001B9A0000-0x000000001B9F6000-memory.dmp

memory/3448-15-0x000000001B1E0000-0x000000001B1EC000-memory.dmp

memory/3448-16-0x000000001B1F0000-0x000000001B1F8000-memory.dmp

memory/3448-17-0x000000001B250000-0x000000001B25C000-memory.dmp

memory/3448-19-0x000000001B270000-0x000000001B282000-memory.dmp

memory/3448-18-0x000000001B260000-0x000000001B268000-memory.dmp

memory/3448-20-0x000000001BF40000-0x000000001C468000-memory.dmp

memory/3448-21-0x000000001B280000-0x000000001B28C000-memory.dmp

memory/3448-23-0x000000001BA20000-0x000000001BA2C000-memory.dmp

memory/3448-22-0x000000001BA10000-0x000000001BA1C000-memory.dmp

memory/3448-24-0x000000001BA30000-0x000000001BA3C000-memory.dmp

memory/3448-27-0x000000001BC50000-0x000000001BC5E000-memory.dmp

memory/3448-26-0x000000001BC40000-0x000000001BC4A000-memory.dmp

memory/3448-30-0x000000001BCC0000-0x000000001BCCC000-memory.dmp

memory/3448-29-0x000000001BC80000-0x000000001BC8E000-memory.dmp

memory/3448-31-0x000000001BC60000-0x000000001BC68000-memory.dmp

memory/3448-32-0x000000001BC90000-0x000000001BC9A000-memory.dmp

memory/3448-34-0x00007FF9A0680000-0x00007FF9A1141000-memory.dmp

memory/3448-33-0x000000001BCA0000-0x000000001BCAC000-memory.dmp

memory/3448-28-0x000000001BC70000-0x000000001BC78000-memory.dmp

memory/3448-25-0x000000001BCB0000-0x000000001BCB8000-memory.dmp

memory/3448-37-0x00007FF9A0680000-0x00007FF9A1141000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RCX3D0A.tmp

MD5 da302f8b90f36acd84743c7639d4e0d0
SHA1 f8fdb617872a6f31fc21b7d7826efba0651077a4
SHA256 a22fcf8eea502fd77a86507ef856f97512aeed2006a0d79f122850f5d14dcf9b
SHA512 cb2392bfd6277ba436ccf0421baccbae4f2b6ef2ecbcd2c72c95de2e3a820a212cd9c7d3662795290341d9c285e75a8a2111fda8bb1ec296a9772689a9af9646

C:\Recovery\WindowsRE\StartMenuExperienceHost.exe

MD5 1612369acf4058a4e10f310696358e8e
SHA1 4849e41889f002b4c22d08d4e39d617d760a9957
SHA256 4fbbf44ec3b3385ce2f4077ae1f3808441388608977e9f1781ef9e4c3cd244da
SHA512 2b35db1717c0f8c2ba34cc649306b46908b246b9db0946cd6260f2ad757b15483f0fca4f37e95bb48257601f802c0d822f6b63156fb0caab6c6bc99009bd24c3

memory/440-137-0x00000277D4A90000-0x00000277D4AB2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iq4bxgqg.q5s.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3448-241-0x00007FF9A0680000-0x00007FF9A1141000-memory.dmp

memory/3872-243-0x000000001B960000-0x000000001B9B6000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 3a6bad9528f8e23fb5c77fbd81fa28e8
SHA1 f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256 986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512 846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 cadef9abd087803c630df65264a6c81c
SHA1 babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256 cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA512 7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 28d4235aa2e6d782751f980ceb6e5021
SHA1 f5d82d56acd642b9fc4b963f684fd6b78f25a140
SHA256 8c66720f953e82cfbd8f00543c42c0cf77c3d97787ec09cb3e1e2ba5819bd638
SHA512 dba1bd6600f5affcfdc33a59e7ac853ee5fdfafb8d1407a1768728bd4f66ef6b49437214716b7e33e3de91d7ce95709050a3dab4354dd62acaf1de28107017a2

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 6c47b3f4e68eebd47e9332eebfd2dd4e
SHA1 67f0b143336d7db7b281ed3de5e877fa87261834
SHA256 8c48b1f2338e5b24094821f41121d2221f1cb3200338f46df49f64d1c4bc3e0c
SHA512 0acf302a9fc971ef9df65ed42c47ea17828e54dff685f4434f360556fd27cdc26a75069f00dcdc14ba174893c6fd7a2cfd8c6c07be3ce35dafee0a006914eaca

C:\Users\Admin\AppData\Local\Temp\e7af6a02-58e4-4c8d-a720-65e599626d92.vbs

MD5 f24aa26f88fc867b9d3643356968f465
SHA1 b26038d0b7029b8b18094a9767401768f85d6284
SHA256 fcfb3978d8777fea3ec2387fe7bbb43d4c4a22407698b239d66fcf0536e2fe95
SHA512 e548cd74e8d29c9e91f7e66560a47aaee6c16acb057c3a18daaeb35ed419f49d112c2f0d56d451048952f036a016c37892e105cb0da0528d79e5287c0a097c58

C:\Users\Admin\AppData\Local\Temp\b22a7699-96b5-47f4-8637-65af61b2ca52.vbs

MD5 add00ddb2b2760189bf9ac5af35fce42
SHA1 1ef78ec44d166f2de1c5703e09781fde00f880af
SHA256 05e07f692f5372b98c2db7b0c0b36bcdc8877a309c219695d3c8f9e28492605d
SHA512 698925fab5bfc9fdfb6e8fd414e95767bef17e6120a56d8b9095d58f576c5afc8925659ea791560f07168626a26070de70a2db4b2e7dc73bb94cac6c663bcdfd

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sihost.exe.log

MD5 49b64127208271d8f797256057d0b006
SHA1 b99bd7e2b4e9ed24de47fb3341ea67660b84cca1
SHA256 2a5d403a2e649d8eceef8f785eeb0f6d33888ec6bbf251b3c347e34cb32b1e77
SHA512 f7c728923c893dc9bc88ad2159e0abcda41e1b40ff7e7756e6252d135ed238a2248a2662b3392449836dd1b0b580f0c866cc33e409527484fe4602e3d3f10e3e

C:\Users\Admin\AppData\Local\Temp\923d7220-d44c-4527-b8af-9bec626431dd.vbs

MD5 cf7aa1538596f8e5929e676255f21be8
SHA1 f18858cc95446300bade57050323640956e498c9
SHA256 31395e1a18722d2a0467476310c49184ec74db1939981175d1e49a8ea8a77c81
SHA512 49aba4758a331ba2bf045c292fc7a3e5a8dd06cce31634df6b14bb679d816cba222028e440ec5f23954f9e5469c993034c97160db9d0c2a342185dd327891ebe

C:\Users\Admin\AppData\Local\Temp\b80c72ab-4b1a-4370-8ac7-2aa9390d9ef9.vbs

MD5 6580843b9e6aed7e6a69b12c362eac67
SHA1 243b85e5f59f2d6523e3b04274701622eeaaa89d
SHA256 a0aecf849c26bc5f4e99b2f117bf4389bae4248f6fb5012824227a3840a93953
SHA512 1f9578d2c2f70c4faebeb8e3e2a78ad45aadcb7528f364e76a337d59e57a217ca9b362bc9df6d1268861738420069ab7d5a5cecbba36328197348ad90e0a6137

memory/3704-301-0x000000001B890000-0x000000001B8E6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\af7c36c7-0295-4088-8a3a-9abf35df05cc.vbs

MD5 12da067833ee64c3fb49acc44ff064a4
SHA1 a1a3dd0138921a6349b6e6f1ac3f135d2ac9054c
SHA256 4f2f0539a9ffd38ea294887ee56090b162b7e82a8586dcbe63af884610857c7a
SHA512 b147a6e087cc66e1d11f01290b994bf1fef4c740649b065a1880a645cfcd66028379791ce7179c83e5e3f16ed3c9d9cd74d2e0a46fa87ca251325de987f775e9

C:\Users\Admin\AppData\Local\Temp\be561dfa-dc37-4c79-a52e-90a82faa7c02.vbs

MD5 a78d0d68f4b612ad314939ba93526ac5
SHA1 b91ca60241b52a908dced55194383e3cc69fba5c
SHA256 ac63a23159542a376d4701c65ad4cf4f9fcde1642d853d5f4f27f8788efb2492
SHA512 dfc2cd5900672176898d510ca42a35052cb9117fe43914fb1e21383b3cc56ed3b812e64dfce444ae999010f8828c84993e4fcf9c3c665d5672e5eab691c87a69

C:\Users\Admin\AppData\Local\Temp\97ef5c2c-3241-42e7-97fc-c81ec8f5b01d.vbs

MD5 4e080ee1e2549821acf3313a99f31d15
SHA1 c913cfdc799e05fae6c72bac590aa8b6e513fee3
SHA256 eb50e1f85c54a3f895f4c9924ad5b47bad4b10559bbb0a09bcaaf91948f5ac11
SHA512 aa0bd601c2997940e768cf9920ad908ae3c03f87fa336fe0885cf2a24a376d2fe03feabd1e6fb6c5073e80c47c9f705c7ab8a66d1edfefaeeb9980e09b7fe1dc

memory/2712-335-0x000000001B860000-0x000000001B872000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1725a334-0402-44a7-a381-3f331601735e.vbs

MD5 ac98d08c2ce1a9a2b9bfd8a4211dc5bd
SHA1 facd4b9e3ecc6312f326abd1b6a73ff324433dcb
SHA256 c095a76f545d35a60b888d0da03d274eabbc445bfd9bc951dbb337104d8d1981
SHA512 ba41e009738d92d7b317cf9036864a169c74774af89a4a4e90bee8bb016590b54f568b59525290f712055ec5ee64375129c9239f3d80940633e2151d156b771c

C:\Users\Admin\AppData\Local\Temp\cfe0eb68-6f62-4a52-8054-7ab417839e89.vbs

MD5 500ccaa9dbe1ae99d9a5ec4f984b8c03
SHA1 63253805538267a7e18aecd84d4dc30f9b3ab177
SHA256 2ca3be88da3a2c49115b8374355b7f368f42cf3a1d49405e6b26b04902940fb5
SHA512 4a45b3a7a3e5c9068aca80066d58d223cc4f59e82e9551b2d3acddf7d516bd08d6b479ff9724a59fc4be2cf05ea1db991a712fed30743ed5fc97f6977571cd40

C:\Users\Admin\AppData\Local\Temp\2e80ad66-59ff-4bea-9db4-0df85139ac48.vbs

MD5 3c9f5867a8bbf0da3de9bb8c6e9a9e53
SHA1 fda167b5a1e0cbad5f561ac4c68585fd5f33c981
SHA256 84c8982be2c730e0ba06d10b2e94f78c82b1e6282bde957bd69f617bf1095f85
SHA512 80dede639660ec50f03fd58a518921ff8e56123e477d56b537c7e49c82f3f0e91afbcee983266cb81dcd8f514eeeb2a680d9b9c319447ea542e1f981bebac713

C:\Users\Admin\AppData\Local\Temp\da35f0d7-f744-4562-a3e7-95625eff0de8.vbs

MD5 75a0eb8f67a090b50449ace08f9225cf
SHA1 8521c2a71c13132dc5eadf1d1e738be2d372df02
SHA256 b612c9369d673a5bddb6dcd6017e30c1d263892fce6ad6f421ca22ca71c91348
SHA512 4d5bb58a9566ebb2ecd266b1194d132f1fa1359ede52de00b2fe2105775be22d33de10b98c071ef1335bc37b4b79195811b0d9ec20ff63afa7c10c216f4a5aac

C:\Users\Admin\AppData\Local\Temp\1063dee0-da0a-43df-afc1-c6d3b34943dc.vbs

MD5 09f71d15b21bbede97aea287845684c7
SHA1 22a473e19abab96bb6803c29f6e8a459095e4a2a
SHA256 addd52c27d7eb761c3adfb5e06f8bc179bdff7f244fa4868d536c34c98b69e2c
SHA512 b6d9db906ee7996914a1423e618b735d59b88272908730706514a7d8e89938d38577fdfbc79c9ac9a32618682e5f14f9c7466e814ecbed9ccab7a8a545532d0b

C:\Users\Admin\AppData\Local\Temp\96434b13-5af3-4a61-96f0-9848579e0e38.vbs

MD5 5d4cbe48f4da0c8b42629868a8114f5c
SHA1 3cb935b6fe13474acd7007f7287fa48783956a47
SHA256 15d79ba1784a87b036c575c5c206d7a43711b446ecba8a38c3efddda61bd760d
SHA512 ef9c4d8a9e53feac8e6101d535511ee18a4d40ab1df940e5eda514bc1fa51a9a0fb77ead0b1f4b52434ac4d00e46f342438d63d270ecd5e1aacf0dfab28415bd

C:\Users\Admin\AppData\Local\Temp\04adecc0-68c2-44b6-b994-64c5fd4d8088.vbs

MD5 2596608fbca2bacc1350ed1abcd0fe34
SHA1 fbfac18975a0fcfa960067952cecc001f308ec7d
SHA256 02026da5bff764763c855951f358fee9052b3f91d5f1011a7500a5cbbad34c1c
SHA512 41a0aa4ae6e05b4cd2aeba69492aa408796cbd86ea2f647ab04c7f15cfc5551adf560196a849c10bad433b46704f4c96bb32fda37f9e757ebd3747e908118ca0