Analysis
- max time kernel
150s - max time network
130s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
25/05/2024, 23:50
General
- Target 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe
- Size 200KB
- Sample240525-3vmqbsfa4v
- SHA256 ef463971ba1d1e13a91563590311c4c546f850d4f9543d16aac3572bf02b5920
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 38 IoCs
- UAC bypass 3 TTPs 38 IoCs
- Renames multiple (87) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 6 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
- Modifies registry key 1 TTPs 64 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\eIQUAQkI\HsMUscgU.exe"C:\Users\Admin\eIQUAQkI\HsMUscgU.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
-
C:\ProgramData\CYsEwkQY\BmUcQsco.exe"C:\ProgramData\CYsEwkQY\BmUcQsco.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"8⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"10⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"12⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"14⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"16⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"18⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV119⤵
-
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"20⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV121⤵
-
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"22⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"24⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"26⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"28⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV129⤵
-
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"30⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"32⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"34⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV135⤵
-
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"36⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"38⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"40⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"42⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"44⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"46⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"48⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV149⤵
-
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"50⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"52⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"54⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"56⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"58⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"60⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"62⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV163⤵
-
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"64⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV165⤵
-
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"66⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"68⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV169⤵
-
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"70⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV171⤵
-
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics71⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"72⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV173⤵
-
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics73⤵
- Adds Run key to start application
-
C:\Users\Admin\pIIEsMYY\YugEokwQ.exe"C:\Users\Admin\pIIEsMYY\YugEokwQ.exe"74⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4160 -s 22475⤵
- Program crash
-
-
-
C:\ProgramData\dAoYUAkI\OuccUEIs.exe"C:\ProgramData\dAoYUAkI\OuccUEIs.exe"74⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 23675⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"74⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV175⤵
-
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"76⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 176⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 276⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV177⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f76⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DigUYkos.bat" "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe""76⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV177⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs77⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 174⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV175⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 274⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f74⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DkYgoAok.bat" "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe""74⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV175⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs75⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 172⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 272⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f72⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YOMcQwkM.bat" "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe""72⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs73⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 170⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 270⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f70⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV171⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OKgMgEUk.bat" "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe""70⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs71⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 168⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV169⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 268⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV169⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f68⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KEcEUUcQ.bat" "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe""68⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV169⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs69⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 166⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV167⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 266⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f66⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ksYIEYsU.bat" "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe""66⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV167⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs67⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 164⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 264⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f64⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oscsYYAA.bat" "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe""64⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV165⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs65⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 162⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 262⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f62⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VkQMYIcA.bat" "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe""62⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs63⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 160⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 260⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f60⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lKwIccIc.bat" "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe""60⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs61⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 158⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV159⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 258⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV159⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f58⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XCcUMYAI.bat" "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe""58⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs59⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 156⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 256⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV157⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f56⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hkoggIYY.bat" "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe""56⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs57⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 154⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 254⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f54⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YUgcokoo.bat" "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe""54⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs55⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 152⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 252⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f52⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UWwcIkQs.bat" "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe""52⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs53⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 150⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 250⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f50⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wUEkoskk.bat" "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe""50⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs51⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 148⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 248⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f48⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DEkIMUIQ.bat" "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe""48⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV149⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs49⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 146⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 246⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f46⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV147⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\laMooIQM.bat" "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe""46⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs47⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 144⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 244⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f44⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZeYUYwcs.bat" "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe""44⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV145⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs45⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 142⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 242⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f42⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIQAAsIE.bat" "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe""42⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs43⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 140⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 240⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f40⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SgkssgYk.bat" "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe""40⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV141⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs41⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 138⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 238⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f38⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV139⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sisEwIUI.bat" "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe""38⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs39⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 136⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 236⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f36⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KGYowMoQ.bat" "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe""36⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs37⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 134⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 234⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f34⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV135⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HSAQogEE.bat" "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe""34⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs35⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 132⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 232⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f32⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV133⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vyMgQQMk.bat" "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe""32⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs33⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 130⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 230⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f30⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HugUUwgg.bat" "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe""30⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs31⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 128⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 228⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f28⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LQkAMMYI.bat" "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe""28⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs29⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 126⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 226⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f26⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mKsEwEAQ.bat" "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe""26⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs27⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 124⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 224⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f24⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\moIwwUYg.bat" "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe""24⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs25⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 122⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 222⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f22⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AkgEsoIk.bat" "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe""22⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs23⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 120⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 220⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f20⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iMUEUcgg.bat" "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe""20⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs21⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 118⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 218⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f18⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bAQQoQgI.bat" "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe""18⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV119⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs19⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 116⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 216⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f16⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XEkcoUIw.bat" "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe""16⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs17⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 114⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 214⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f14⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV115⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VyssMoIE.bat" "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe""14⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs15⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 112⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 212⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f12⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\muowcMAE.bat" "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe""12⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs13⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eOUEcgcI.bat" "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe""10⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iQEcQMgs.bat" "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe""8⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WOccgQEs.bat" "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe""6⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XqUwgEAk.bat" "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jMgccQwY.bat" "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4232,i,1067197275908310731,12785105794523264014,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:81⤵
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4160 -ip 41602⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1520 -ip 15202⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
BmUcQsco.exe
BmUcQsco.inf
background.png.exe
background.png.exe
device.png.exe
device.png.exe
overlay.png.exe
overlay.png.exe
superbar.png.exe
superbar.png.exe
background.png.exe
watermark.png.exe
guest.bmp.exe
guest.png.exe
user-192.png.exe
user.png.exe
vcredist_x86.exe
VC_redist.x86.exe
VC_redist.x64.exe
vcredist_x86.exe
windowsdesktop-runtime-8.0.2-win-x64.exe
vcredist_x64.exe
windowsdesktop-runtime-6.0.27-win-x64.exe
windowsdesktop-runtime-7.0.16-win-x64.exe
flapper.gif.exe
128.png.exe
256.png.exe
32.png.exe
48.png.exe
64.png.exe
96.png.exe
128.png.exe
192.png.exe
256.png.exe
64.png.exe
96.png.exe
256.png.exe
128.png.exe
192.png.exe
256.png.exe
32.png.exe
48.png.exe
64.png.exe
128.png.exe
256.png.exe
128.png.exe
256.png.exe
AppBlue.png.exe
AppErrorWhite.png.exe
AutoPlayOptIn.gif.exe
ElevatedAppBlue.png.exe
Error.png.exe
OneDriveLogo.png.exe
QuotaCritical.png.exe
QuotaError.png.exe
ScreenshotOptIn.gif.exe
Warning.png.exe
OneDriveMedTile.contrast-white_scale-400.png.exe
OneDriveSmallTile.contrast-black_scale-400.png.exe
OneDriveSmallTile.contrast-white_scale-400.png.exe
OneDriveSmallTile.scale-400.png.exe
OneDrive.exe
squaretile.png.exe
tinytile.png.exe
squaretile.png.exe
tinytile.png.exe
squaretile.png.exe
38f268c9bcf9ea423536692a5155e550_NeikiAnalytics
Acwq.exe
AksU.exe
CsES.exe
EUwg.exe
Eokm.exe
EsIk.exe
GAUe.exe
IgAu.exe
OcUs.exe
OgcQ.ico
OkAs.exe
QYIk.exe
SoEY.exe
UIku.exe
UQcY.exe
UwAM.exe
WYAM.exe
Wgcs.exe
YoQw.ico
coAG.exe
file.vbs
gssQ.exe
icUw.exe
iwsU.exe
jMgccQwY.bat
kYgo.exe
kgwo.exe
mkcY.exe
oAgG.exe
oMcC.exe
ocEI.exe
qEUc.exe
qMsY.exe
sEQW.exe
scEs.exe
sgkg.exe
swoE.exe
uEQg.ico
wYEK.exe
wwgu.ico
CheckpointTrace.ppt.exe
JoinEnter.wma.exe
MergeStop.bmp.exe
SplitAdd.wma.exe
StopRequest.rar.exe
ExitCopy.mpg.exe
RevokeUnprotect.wma.exe
SaveInitialize.mp3.exe
UndoUninstall.mp3.exe
My Wallpaper.jpg.exe
UnlockRedo.jpg.exe
HsMUscgU.exe
HsMUscgU.inf
memory/220-281-0x0000000000400000-0x0000000000434000-memory.dmp
memory/220-295-0x0000000000400000-0x0000000000434000-memory.dmp
memory/336-324-0x0000000000400000-0x0000000000434000-memory.dmp
memory/336-314-0x0000000000400000-0x0000000000434000-memory.dmp
memory/524-370-0x0000000000400000-0x0000000000434000-memory.dmp
memory/524-360-0x0000000000400000-0x0000000000434000-memory.dmp
memory/764-398-0x0000000000400000-0x0000000000434000-memory.dmp
memory/956-181-0x0000000000400000-0x0000000000434000-memory.dmp
memory/956-166-0x0000000000400000-0x0000000000434000-memory.dmp
memory/964-218-0x0000000000400000-0x0000000000434000-memory.dmp
memory/964-204-0x0000000000400000-0x0000000000434000-memory.dmp
memory/992-57-0x0000000000400000-0x0000000000434000-memory.dmp
memory/992-45-0x0000000000400000-0x0000000000434000-memory.dmp
memory/1060-94-0x0000000000400000-0x0000000000434000-memory.dmp
memory/1520-423-0x0000000000400000-0x0000000000433000-memory.dmp
memory/1520-409-0x0000000000400000-0x0000000000433000-memory.dmp
memory/1680-230-0x0000000000400000-0x0000000000434000-memory.dmp
memory/1680-219-0x0000000000400000-0x0000000000434000-memory.dmp
memory/1852-105-0x0000000000400000-0x0000000000434000-memory.dmp
memory/1852-119-0x0000000000400000-0x0000000000434000-memory.dmp
memory/2004-46-0x0000000000400000-0x0000000000434000-memory.dmp
memory/2004-30-0x0000000000400000-0x0000000000434000-memory.dmp
memory/2060-291-0x0000000000400000-0x0000000000434000-memory.dmp
memory/2060-304-0x0000000000400000-0x0000000000434000-memory.dmp
memory/2140-267-0x0000000000400000-0x0000000000434000-memory.dmp
memory/2140-258-0x0000000000400000-0x0000000000434000-memory.dmp
memory/2140-0-0x0000000000400000-0x0000000000434000-memory.dmp
memory/2140-20-0x0000000000400000-0x0000000000434000-memory.dmp
memory/2284-275-0x0000000000400000-0x0000000000434000-memory.dmp
memory/2312-376-0x0000000000400000-0x0000000000434000-memory.dmp
memory/2312-388-0x0000000000400000-0x0000000000434000-memory.dmp
memory/2352-333-0x0000000000400000-0x0000000000434000-memory.dmp
memory/2352-320-0x0000000000400000-0x0000000000434000-memory.dmp
memory/2420-34-0x0000000000400000-0x0000000000434000-memory.dmp
memory/2420-16-0x0000000000400000-0x0000000000434000-memory.dmp
memory/2612-71-0x0000000000400000-0x0000000000434000-memory.dmp
memory/2632-156-0x0000000000400000-0x0000000000434000-memory.dmp
memory/2680-8-0x0000000000400000-0x0000000000431000-memory.dmp
memory/2680-2196-0x0000000000400000-0x0000000000431000-memory.dmp
memory/3056-120-0x0000000000400000-0x0000000000434000-memory.dmp
memory/3056-131-0x0000000000400000-0x0000000000434000-memory.dmp
memory/3288-312-0x0000000000400000-0x0000000000434000-memory.dmp
memory/3288-303-0x0000000000400000-0x0000000000434000-memory.dmp
memory/3400-180-0x0000000000400000-0x0000000000434000-memory.dmp
memory/3400-193-0x0000000000400000-0x0000000000434000-memory.dmp
memory/3532-338-0x0000000000400000-0x0000000000434000-memory.dmp
memory/3532-351-0x0000000000400000-0x0000000000434000-memory.dmp
memory/4160-422-0x0000000000400000-0x0000000000432000-memory.dmp
memory/4160-408-0x0000000000400000-0x0000000000432000-memory.dmp
memory/4300-361-0x0000000000400000-0x0000000000434000-memory.dmp
memory/4428-257-0x0000000000400000-0x0000000000434000-memory.dmp
memory/4428-240-0x0000000000400000-0x0000000000434000-memory.dmp
memory/4440-132-0x0000000000400000-0x0000000000434000-memory.dmp
memory/4440-143-0x0000000000400000-0x0000000000434000-memory.dmp
memory/4468-329-0x0000000000400000-0x0000000000434000-memory.dmp
memory/4468-342-0x0000000000400000-0x0000000000434000-memory.dmp
memory/4472-15-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4472-2201-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4752-244-0x0000000000400000-0x0000000000434000-memory.dmp
memory/4840-207-0x0000000000400000-0x0000000000434000-memory.dmp
memory/4840-192-0x0000000000400000-0x0000000000434000-memory.dmp
memory/4852-379-0x0000000000400000-0x0000000000434000-memory.dmp
memory/4852-369-0x0000000000400000-0x0000000000434000-memory.dmp
memory/4916-106-0x0000000000400000-0x0000000000434000-memory.dmp
memory/4916-90-0x0000000000400000-0x0000000000434000-memory.dmp
memory/4928-82-0x0000000000400000-0x0000000000434000-memory.dmp
memory/4928-67-0x0000000000400000-0x0000000000434000-memory.dmp
memory/4996-411-0x0000000000400000-0x0000000000434000-memory.dmp
memory/4996-421-0x0000000000400000-0x0000000000434000-memory.dmp
memory/5020-394-0x0000000000400000-0x0000000000434000-memory.dmp
memory/5020-406-0x0000000000400000-0x0000000000434000-memory.dmp
memory/5036-169-0x0000000000400000-0x0000000000434000-memory.dmp
memory/5036-153-0x0000000000400000-0x0000000000434000-memory.dmp
memory/5048-285-0x0000000000400000-0x0000000000434000-memory.dmp
memory/5112-410-0x0000000000400000-0x0000000000434000-memory.dmp