Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 16:25
Static task
static1
Behavioral task
behavioral1
Sample
710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe
-
Size
191KB
-
MD5
710c4a77cf07ffd806e0cc60e837cb10
-
SHA1
e2d9719ea89288a872156a52b4a73801163dca48
-
SHA256
727dd0e15f2f47a4783cc6db548243fccb2b8e34cae35b00c0848e741388ac42
-
SHA512
0edb053c63290b411b06f15167b328358075fb377d4d8b276ac72dc0b976b21ba7e970d454dbc8dfaf1424458232e23bf103052279dcc1e0da6023404a6062b3
-
SSDEEP
3072:PMCGKtFAO6en/0Iyq2021ly+ufsnOGPyyKE7VjqDT5hzZ/D7BoBS70h6L3e:PMAFAO6MtF2pOGPdVK5fuGre
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (83) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
UIssoAYc.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation UIssoAYc.exe -
Executes dropped EXE 2 IoCs
Processes:
JisAokUk.exeUIssoAYc.exepid process 3916 JisAokUk.exe 3580 UIssoAYc.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeUIssoAYc.exeJisAokUk.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\JisAokUk.exe = "C:\\Users\\Admin\\SQoIcAMo\\JisAokUk.exe" 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UIssoAYc.exe = "C:\\ProgramData\\hkYgIYQA\\UIssoAYc.exe" 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UIssoAYc.exe = "C:\\ProgramData\\hkYgIYQA\\UIssoAYc.exe" UIssoAYc.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\JisAokUk.exe = "C:\\Users\\Admin\\SQoIcAMo\\JisAokUk.exe" JisAokUk.exe -
Drops file in System32 directory 2 IoCs
Processes:
UIssoAYc.exedescription ioc process File created C:\Windows\SysWOW64\shell32.dll.exe UIssoAYc.exe File opened for modification C:\Windows\SysWOW64\shell32.dll.exe UIssoAYc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 6072 reg.exe 1076 reg.exe 2440 reg.exe 872 reg.exe 5768 reg.exe 2376 reg.exe 3912 reg.exe 5436 reg.exe 1548 reg.exe 872 reg.exe 1904 reg.exe 2000 reg.exe 3840 reg.exe 3652 reg.exe 3008 reg.exe 5392 reg.exe 2928 reg.exe 2028 reg.exe 2760 reg.exe 3124 reg.exe 3448 reg.exe 688 reg.exe 5744 reg.exe 5692 reg.exe 5684 reg.exe 4972 reg.exe 4488 reg.exe 1220 reg.exe 1856 reg.exe 4040 reg.exe 3680 reg.exe 2956 reg.exe 4360 reg.exe 4884 reg.exe 1172 reg.exe 4200 reg.exe 3952 reg.exe 4884 reg.exe 6044 reg.exe 3136 reg.exe 4940 reg.exe 4136 reg.exe 4208 reg.exe 4912 reg.exe 824 reg.exe 3104 reg.exe 1988 reg.exe 6008 reg.exe 4640 reg.exe 2040 reg.exe 320 reg.exe 4916 reg.exe 2472 reg.exe 1236 reg.exe 2476 reg.exe 1904 reg.exe 2996 reg.exe 1172 reg.exe 2660 reg.exe 1056 reg.exe 4948 reg.exe 1576 reg.exe 3004 reg.exe 1060 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exepid process 3008 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 3008 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 3008 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 3008 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 4148 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 4148 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 4148 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 4148 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 5140 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 5140 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 5140 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 5140 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 4844 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 4844 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 4844 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 4844 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 3480 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 3480 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 3480 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 3480 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 5860 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 5860 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 5860 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 5860 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 5960 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 5960 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 5960 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 5960 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 1860 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 1860 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 1860 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 1860 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 4972 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 4972 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 4972 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 4972 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 3492 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 3492 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 3492 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 3492 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 2428 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 2428 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 2428 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 2428 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 3672 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 3672 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 3672 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 3672 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 368 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 368 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 368 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 368 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 1244 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 1244 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 1244 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 1244 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 1284 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 1284 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 1284 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 1284 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 5404 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 5404 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 5404 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 5404 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
UIssoAYc.exepid process 3580 UIssoAYc.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
UIssoAYc.exepid process 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe 3580 UIssoAYc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.execmd.execmd.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.execmd.execmd.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.execmd.exedescription pid process target process PID 3008 wrote to memory of 3916 3008 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe JisAokUk.exe PID 3008 wrote to memory of 3916 3008 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe JisAokUk.exe PID 3008 wrote to memory of 3916 3008 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe JisAokUk.exe PID 3008 wrote to memory of 3580 3008 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe UIssoAYc.exe PID 3008 wrote to memory of 3580 3008 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe UIssoAYc.exe PID 3008 wrote to memory of 3580 3008 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe UIssoAYc.exe PID 3008 wrote to memory of 5244 3008 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe cmd.exe PID 3008 wrote to memory of 5244 3008 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe cmd.exe PID 3008 wrote to memory of 5244 3008 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe cmd.exe PID 5244 wrote to memory of 4148 5244 cmd.exe 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe PID 5244 wrote to memory of 4148 5244 cmd.exe 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe PID 5244 wrote to memory of 4148 5244 cmd.exe 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe PID 3008 wrote to memory of 3908 3008 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 3008 wrote to memory of 3908 3008 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 3008 wrote to memory of 3908 3008 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 3008 wrote to memory of 4832 3008 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 3008 wrote to memory of 4832 3008 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 3008 wrote to memory of 4832 3008 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 3008 wrote to memory of 1220 3008 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 3008 wrote to memory of 1220 3008 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 3008 wrote to memory of 1220 3008 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 3008 wrote to memory of 2852 3008 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe cmd.exe PID 3008 wrote to memory of 2852 3008 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe cmd.exe PID 3008 wrote to memory of 2852 3008 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe cmd.exe PID 2852 wrote to memory of 3188 2852 cmd.exe cscript.exe PID 2852 wrote to memory of 3188 2852 cmd.exe cscript.exe PID 2852 wrote to memory of 3188 2852 cmd.exe cscript.exe PID 4148 wrote to memory of 5368 4148 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe cmd.exe PID 4148 wrote to memory of 5368 4148 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe cmd.exe PID 4148 wrote to memory of 5368 4148 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe cmd.exe PID 5368 wrote to memory of 5140 5368 cmd.exe 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe PID 5368 wrote to memory of 5140 5368 cmd.exe 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe PID 5368 wrote to memory of 5140 5368 cmd.exe 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe PID 4148 wrote to memory of 5964 4148 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 4148 wrote to memory of 5964 4148 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 4148 wrote to memory of 5964 4148 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 4148 wrote to memory of 5136 4148 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 4148 wrote to memory of 5136 4148 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 4148 wrote to memory of 5136 4148 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 4148 wrote to memory of 3104 4148 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 4148 wrote to memory of 3104 4148 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 4148 wrote to memory of 3104 4148 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 4148 wrote to memory of 1856 4148 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe cmd.exe PID 4148 wrote to memory of 1856 4148 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe cmd.exe PID 4148 wrote to memory of 1856 4148 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe cmd.exe PID 1856 wrote to memory of 5500 1856 cmd.exe cscript.exe PID 1856 wrote to memory of 5500 1856 cmd.exe cscript.exe PID 1856 wrote to memory of 5500 1856 cmd.exe cscript.exe PID 5140 wrote to memory of 4916 5140 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe cmd.exe PID 5140 wrote to memory of 4916 5140 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe cmd.exe PID 5140 wrote to memory of 4916 5140 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe cmd.exe PID 5140 wrote to memory of 5164 5140 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 5140 wrote to memory of 5164 5140 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 5140 wrote to memory of 5164 5140 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 5140 wrote to memory of 4528 5140 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 5140 wrote to memory of 4528 5140 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 5140 wrote to memory of 4528 5140 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 5140 wrote to memory of 5416 5140 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 5140 wrote to memory of 5416 5140 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 5140 wrote to memory of 5416 5140 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 5140 wrote to memory of 4240 5140 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe cmd.exe PID 5140 wrote to memory of 4240 5140 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe cmd.exe PID 5140 wrote to memory of 4240 5140 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe cmd.exe PID 4240 wrote to memory of 4368 4240 cmd.exe cscript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\SQoIcAMo\JisAokUk.exe"C:\Users\Admin\SQoIcAMo\JisAokUk.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\ProgramData\hkYgIYQA\UIssoAYc.exe"C:\ProgramData\hkYgIYQA\UIssoAYc.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"6⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"8⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"10⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"12⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"14⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"16⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"18⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"20⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"22⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"24⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"26⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"28⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"30⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"32⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"34⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"36⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"38⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"40⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"42⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"44⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"46⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"48⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV149⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"50⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"52⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"54⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"56⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"58⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"60⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"62⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"64⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"66⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"68⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"70⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics71⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"72⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics73⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"74⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"76⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics77⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"78⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics79⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"80⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics81⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"82⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics83⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"84⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics85⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"86⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV187⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics87⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"88⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics89⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"90⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"92⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics93⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"94⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics95⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"96⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics97⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"98⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV199⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics99⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"100⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1101⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics101⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"102⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics103⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"104⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics105⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"106⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics107⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"108⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics109⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"110⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics111⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"112⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics113⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"114⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics115⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"116⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics117⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"118⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics119⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"120⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics121⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"122⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1123⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics123⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"124⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics125⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"126⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics127⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"128⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics129⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"130⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics131⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"132⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics133⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"134⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics135⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"136⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics137⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"138⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics139⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"140⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics141⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"142⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics143⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"144⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics145⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"146⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics147⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"148⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1149⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics149⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"150⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1151⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics151⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"152⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics153⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"154⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics155⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"156⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1157⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics157⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"158⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics159⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"160⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics161⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"162⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics163⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"164⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics165⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"166⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics167⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"168⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics169⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"170⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics171⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"172⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1173⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics173⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"174⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics175⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"176⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics177⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"178⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics179⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"180⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics181⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"182⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics183⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"184⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics185⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"186⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics187⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"188⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics189⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"190⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics191⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"192⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics193⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"194⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics195⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"196⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics197⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"198⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1199⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics199⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"200⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics201⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"202⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics203⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"204⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics205⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"206⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1207⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics207⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"208⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics209⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"210⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics211⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"212⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics213⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"214⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics215⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"216⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics217⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"218⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1219⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics219⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"220⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics221⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"222⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1223⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics223⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"224⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics225⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"226⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1227⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics227⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"228⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics229⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"230⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics231⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"232⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics233⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"234⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1235⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1234⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2234⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f234⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bakwgMks.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""234⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs235⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1232⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2232⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f232⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gqAkgYww.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""232⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs233⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1230⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2230⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1231⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f230⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sKwYoUUU.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""230⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1231⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs231⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1228⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2228⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1229⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f228⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qCsosogs.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""228⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs229⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1226⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2226⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1227⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f226⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HwkUocQw.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""226⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1227⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs227⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1224⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2224⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f224⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JUQQwEcM.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""224⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs225⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1222⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2222⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1223⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f222⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1223⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zCUwMQQA.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""222⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1223⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs223⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1220⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1221⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2220⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1221⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f220⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1221⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RGMYEEYQ.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""220⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1221⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs221⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1218⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2218⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1219⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f218⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1219⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OmEUwIQg.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""218⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs219⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1216⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2216⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f216⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oiYMsAYc.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""216⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1217⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs217⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1214⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2214⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f214⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eQMYcowk.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""214⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs215⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1212⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2212⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1213⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f212⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\meIMsQQE.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""212⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs213⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1210⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2210⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f210⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JOgMUMEk.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""210⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs211⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1208⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2208⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f208⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hmgYcUIo.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""208⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs209⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1206⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2206⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1207⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f206⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1207⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xOgoAMIo.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""206⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs207⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1204⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2204⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f204⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qCQMUAwk.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""204⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs205⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1202⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2202⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f202⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KoQEYgMo.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""202⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1203⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs203⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1200⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2200⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f200⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qKQAEEgE.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""200⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs201⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1198⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2198⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1199⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f198⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1199⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HsAAEcIM.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""198⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs199⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1196⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2196⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f196⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1197⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RIUsQwgA.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""196⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs197⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1194⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2194⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f194⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DyQUAwQc.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""194⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs195⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1192⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2192⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f192⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ryEockcI.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""192⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1193⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs193⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1190⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2190⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f190⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1191⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AWUMEMAA.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""190⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs191⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1188⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2188⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1189⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f188⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ImAgMkYc.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""188⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs189⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1186⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2186⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f186⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1187⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MmMwEgAU.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""186⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs187⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1184⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2184⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f184⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xIggMMQk.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""184⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs185⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1182⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2182⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f182⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1183⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jAUMIEsg.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""182⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs183⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1180⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2180⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f180⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1181⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vIYcYUwg.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""180⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1181⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs181⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1178⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2178⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f178⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1179⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AOwQIkcI.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""178⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs179⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1176⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2176⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f176⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oQUAIAkI.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""176⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs177⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1174⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2174⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1175⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f174⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cSIgcEcY.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""174⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1175⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs175⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1172⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2172⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f172⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jkUsAgAI.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""172⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs173⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1170⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2170⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f170⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pkMUUYwg.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""170⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs171⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1168⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2168⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1169⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f168⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TUcwsAoQ.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""168⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs169⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1166⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2166⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1167⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f166⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UKAEAwoQ.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""166⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs167⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1164⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1165⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2164⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1165⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f164⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ikEkUYgE.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""164⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs165⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1162⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2162⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f162⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QEMYcgsQ.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""162⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs163⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1160⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2160⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f160⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DIMEIMos.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""160⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs161⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1158⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2158⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f158⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VCoIUkAw.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""158⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs159⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1156⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2156⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f156⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PIUAssMI.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""156⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs157⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1154⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2154⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f154⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jmsgwoUQ.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""154⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1155⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs155⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1152⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1153⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2152⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f152⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QwUEAcUg.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""152⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs153⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1150⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2150⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1151⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f150⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gekcMwIY.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""150⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs151⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1148⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2148⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f148⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zeQYsIQk.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""148⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs149⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1146⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2146⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f146⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DqgQEIAE.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""146⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1147⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs147⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1144⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2144⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1145⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f144⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bYkMUEEM.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""144⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs145⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1142⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1143⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2142⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1143⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f142⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yakwkEgU.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""142⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs143⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1140⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1141⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2140⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f140⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cQMssgoU.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""140⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs141⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1138⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2138⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1139⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f138⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QyEYksUE.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""138⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs139⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1136⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2136⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f136⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eCgksMoo.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""136⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs137⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1134⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1135⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2134⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f134⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NUQQMcIk.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""134⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs135⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1132⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2132⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f132⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DykUAsYo.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""132⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs133⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1130⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2130⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f130⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoYkEMAI.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""130⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs131⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1128⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2128⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1129⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f128⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hOwQMUEM.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""128⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs129⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1126⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2126⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f126⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gmsMgoQs.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""126⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs127⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1124⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2124⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f124⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WcgkEwcI.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""124⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1125⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs125⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1122⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2122⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1123⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f122⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AMAkcskM.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""122⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs123⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1120⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2120⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f120⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1121⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xuYwsgUM.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""120⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1121⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs121⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1118⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1119⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2118⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f118⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\joQwUoQs.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""118⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs119⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1116⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2116⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f116⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nIgYIUEs.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""116⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1117⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs117⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1114⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2114⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f114⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JQIUMMwc.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""114⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs115⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1112⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2112⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f112⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AaAsgwco.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""112⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs113⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1110⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1111⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2110⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f110⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wGcsQUwA.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""110⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs111⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1108⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1109⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2108⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f108⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eCUMUEkE.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""108⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1109⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs109⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1106⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2106⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f106⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gGQYEccM.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""106⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs107⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1104⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2104⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f104⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bqwEEIkM.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""104⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1105⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs105⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1102⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2102⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f102⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dIQEEIkU.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""102⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs103⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1100⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1101⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2100⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f100⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PQwskcMM.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""100⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1101⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs101⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 198⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 298⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f98⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VoMwEoIk.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""98⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs99⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 196⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 296⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f96⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cyIskIgs.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""96⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs97⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 194⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 294⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f94⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ACwcwgMw.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""94⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs95⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 192⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 292⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f92⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iMUwYYco.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""92⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs93⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 190⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 290⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f90⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NUYQQsUA.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""90⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs91⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 188⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 288⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f88⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TkwsQEIA.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""88⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs89⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 186⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 286⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV187⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f86⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DGQYsQMU.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""86⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs87⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 184⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 284⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV185⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f84⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QqogwEII.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""84⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs85⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 182⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 282⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f82⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aAsQMMMY.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""82⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs83⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 180⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 280⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f80⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CAwoUQYA.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""80⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV181⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs81⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 178⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 278⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f78⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV179⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DsQAUgsI.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""78⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs79⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 176⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 276⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f76⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XKosYoIg.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""76⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs77⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 174⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 274⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f74⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZGEEsMIo.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""74⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs75⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 172⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 272⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV173⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f72⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\boUUIgYU.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""72⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs73⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 170⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 270⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f70⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WggoUswQ.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""70⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs71⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 168⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 268⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f68⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eyMAkIAQ.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""68⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs69⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 166⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV167⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 266⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f66⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IQosQocM.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""66⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs67⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 164⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 264⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f64⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gGgwMUYc.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""64⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs65⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 162⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 262⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f62⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TGsoocoQ.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""62⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs63⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 160⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 260⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f60⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xuAQcwUs.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""60⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs61⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 158⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 258⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f58⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lCMIcUgg.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""58⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs59⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 156⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 256⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f56⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV157⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kKoQgIoQ.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""56⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs57⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 154⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 254⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f54⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\scQwwoAQ.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""54⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs55⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 152⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 252⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f52⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IQMoAQYQ.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""52⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs53⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 150⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 250⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f50⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eyAoEIwA.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""50⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs51⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 148⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV149⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 248⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f48⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\McsEUwkc.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""48⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs49⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 146⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 246⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f46⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV147⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RcsYgEgc.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""46⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs47⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 144⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 244⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f44⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RqwIwEIw.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""44⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs45⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 142⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 242⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f42⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bGwwoAIs.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""42⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs43⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 140⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 240⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f40⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dosYgQYs.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""40⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs41⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 138⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 238⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f38⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YaQsgwcc.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""38⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs39⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 136⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 236⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f36⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GQYQsQMM.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""36⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs37⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 134⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 234⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f34⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mEQgwUYI.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""34⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs35⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 132⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 232⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f32⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DkAoMIAo.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""32⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs33⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 130⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 230⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f30⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\roIkcIEw.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""30⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs31⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 128⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 228⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f28⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tOkQIsYE.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""28⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs29⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 126⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 226⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f26⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zaYUgwcY.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""26⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs27⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 124⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 224⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f24⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EAEYEQAQ.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""24⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs25⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 122⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 222⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f22⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gOAQMIUs.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""22⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs23⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 120⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 220⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f20⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iMAkoQoo.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""20⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs21⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 118⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 218⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f18⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iuAcUkEc.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""18⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs19⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 116⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 216⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f16⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xGgwcYsg.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""16⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs17⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 114⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 214⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f14⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vYkIowog.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""14⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs15⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 112⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 212⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f12⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VaIUIYUs.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""12⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs13⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pAIkAsks.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""10⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SqsskAQo.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""8⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UaUEEYkI.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aGQMwwkc.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TWgMQMYo.bat" "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.exeFilesize
232KB
MD5c1405a2ad7989f178ccaaf4d48975be5
SHA18c5b787c96b2c324e14ac498bb794eaa592a0bfd
SHA25644903470879bda5e20823ae77e383584d479cf35601db9c386d2137af5d96b83
SHA512cf4bea2b7dc36d3f5e8e82387e0d0dead0d0bf4d67425a7a19dc4d8f25f379cc7fe41643c06b1011522012194e0ae5f7c98b1244f8f654db5ceebfffc4ff4c7a
-
C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.exeFilesize
207KB
MD58319994d9f905eef760e9338c16c58e5
SHA15c5e766ffdd4ed131638455c861c7dba4e31b5bf
SHA2563239378fc83f851dc57b168d4bd33bfcce80bea9f0aa4b9632e3f4271357116b
SHA5125b969db2ec0b0e438d0c4e4eb7a1fd3fa16c04c6c0ab7e206548ddc5f2f5fb548ee82d39ae0a6c84def37a83195e2365452e88be9c870a80747b8c1451b5a016
-
C:\ProgramData\Microsoft\User Account Pictures\user-192.png.exeFilesize
199KB
MD531c7f27b25f026c9d85f59438cb845db
SHA1453cd98a735201b4a5e1f13b5e02bf1b74b8068d
SHA256c8f819c04221cb92b25b3099ddfa4ad0e8768faaa7d1cc2f1d92cd97b4ebc81e
SHA5123d4f891ca5388a31baf97aa8260a060a247de2cc391cc6ba66dca1ca9856c02fe63b6a195d376b2ccfd605a9df9dfd0dfe99409d1b2b59b2b8e7a717fd870f6c
-
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exeFilesize
636KB
MD563012115cb14c22055e92f285f8017eb
SHA120fe6c798b653f500ef545ced9c43db8dd0f6956
SHA2560f4b2bf218f3701f40571738ffff64b44721a2451696aa557ceec0f27fc86351
SHA5127f2e9fe5bfdb91f872a7c6d37d7953074ee7b70c3411b288fca53d33ecd80679085d92f06e80c62f233fd09094b2af5cb16ac85e93afc8b13fd963d0cc0b2e20
-
C:\ProgramData\hkYgIYQA\UIssoAYc.exeFilesize
188KB
MD580d63bb7b2534c1c2202a8aad8128a25
SHA170848d6d89ce655da24cbb1a531c8f2d9e2f03bf
SHA256376ce8654d788110f7a18ebe8b37304a1d14d16a0a1d52bc12f8d0c0b40c41cd
SHA51202d942b395220a752b7fbfa833ba8d6f4e75c8d5578658b9e3f92648b62e9644e137def1c5dd05d9b773671e38416e02d3f540d011f9348ce93999862c0a3d98
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\192.png.exeFilesize
200KB
MD5a15e65a61682046fe399433fd30406dd
SHA14add91bc6d4a752954c1acf42ef98bb3dceba975
SHA2568a4b952ff78c6b115bca1f00f71ec8064a469f7489141421b44a851b12c4b1ab
SHA5128b688c38b7d38d206169087049e8eb0f6b5aa02d40f9fbadedae52b5234b6c92e24b4246f26ffd997df1b8184334371957dd7c09c07e489586e9b1308e6a7b2f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\96.png.exeFilesize
203KB
MD5a2831a8ca692c35b67cd62216f73ed29
SHA103c00093bb46989607b6803aeacfed8b3c4af493
SHA256398646e084bba1e422add469fbee1fe5f6b5f52be2b4e211befa0cd9f6ac6907
SHA51249b43f733e311b8adfb79a118822096f953bd996e3a251c990b50f463d2b01745fed2af5b41bf6c8ab100efd913cda37574a01fcf783ba2b802d569753cd7b43
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.png.exeFilesize
201KB
MD53c0a73ff281edd5ae21449795f17e654
SHA1787b091cd3d3fe6953bf5b0ab662e1b32de6d711
SHA2562c108c3abd6842b3c87e121ca0fec668ffb0d14ceb8aff47a67ccb18cda3dee8
SHA512c33be3fc45204772ea69996ca94b624898058a2ed4e5c5e5da87a2b58a981b5aa91d109c089001ccf6104131ff72d4b245aa8f49fa0de2ce22f94999a2ca514e
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalyticsFilesize
6KB
MD596b5a5aa81cddc217e02a83da419a8ea
SHA12f005ac25837210b71780fbf0d44b1b1da873749
SHA25650bc79f388a6f6a3abfd401ede993aa67626207b6ab63320fd44879ef73fda3c
SHA512bcbfe061efd4a2e60ae16f0ff2432411b3a23b5644f52b596e9b47d699933683c93e0174107520b60c010504c070bbc41aa3b704798ef400c3ddd814fde271cc
-
C:\Users\Admin\AppData\Local\Temp\AEIY.exeFilesize
239KB
MD52bb1b752d7d5f1aab8b7c6d03375ebd7
SHA19949880fdef5c41e9345fbe02457cb906f1d76aa
SHA256dc08c963b7357ac5a4cab1194441dc5d1a1c16b9c3c14c6f6b0ddf665cca5f1e
SHA512298d24dafc2ed89400b5a2d726324139134645d829b4d37239ae6219688e51ec014e6a2215179d0a3883736baab6bb4a8fe0e3bdac48678901cf4a9f12aa33d5
-
C:\Users\Admin\AppData\Local\Temp\AYIy.exeFilesize
443KB
MD5e3dd546f05612ca4b8d797e65c62d99f
SHA120c0075c46ae38d4782d6b92be76689b8be1b54b
SHA25664fd24ac449215d9dbe3376fe96b2916e989b42588c20b1acc5c9bd4430bf37a
SHA5124a351d1586519586772fbef762d7abdab2171af27ee3fb44c2a9cd13940521fbbcafdd07a0817ce83a64daf1b94e24d09c559f4a946e2000e8b8b85879b76124
-
C:\Users\Admin\AppData\Local\Temp\AgUA.exeFilesize
336KB
MD5959b6020b8b77d51dad20880c9b75a82
SHA1ff77b806a77b4c551c38b4a3f60ce85f328d17ec
SHA256bb9ee7fecde5efb80c641229d3dbedd2d6a88e41183737ec7a90c4a5f52a45dd
SHA512118a2cc58b1da55fbfa560164c5df9294b801fde9cce2bb32a709b87f3ba1de8884072b367be65bbcecf83775f5662bfaaeafb3bb4fa9bec7dab2f4871372341
-
C:\Users\Admin\AppData\Local\Temp\AkEu.exeFilesize
200KB
MD520f8178abbcf3bd1762839cc0f6bd322
SHA15bdb48346cf89932ed66046b95cdb81a275d504a
SHA2565c64dc12772f7cc9b4172ca249467a979ec56c8f1cef7a785c7f15f389f21d23
SHA5127d6021ac00e07a39f9fb8f8b9edb062a54af548a624b40e33542b4e64218c68b120f43344485e216b6904336a6f2fdb4344221bfca58b2309214cb51398ddfa8
-
C:\Users\Admin\AppData\Local\Temp\CAIe.exeFilesize
203KB
MD5b2a1604392ecd9b7e45e3af0323ece38
SHA1cb78fafb5b46d680539f1c6a53a8097c0d74a25f
SHA256c62d742284547e544710ac1622626ab425f683689aea8739ca9dc542ea0dcfd9
SHA5123db1117e336f2e2e14966cf7c652389c7332dbfd560fc24cb79a929fee1198007d8521183fca0c44b576e485cbe98dc20f9642d8081130d934714115585ae8d5
-
C:\Users\Admin\AppData\Local\Temp\CAcK.exeFilesize
1.4MB
MD58df4b8d994234fedd857d3b7c78801f9
SHA106fb5b350f7ef2c2b3d8a2e2f219f055eaf49d3c
SHA25613ac2ed95aec6d26cdbaa47cd5a3c538367883fcd80c86a59141d6a160f08a6b
SHA5121c463c39026c5ab63fe21fb2fa20060926764341e7015439c98f82aa0a2e24a64e48d3b20ca121379d363d4821241f29049ad8f498f746544eac2fea2ab90af1
-
C:\Users\Admin\AppData\Local\Temp\CIQu.exeFilesize
201KB
MD55a66885b59bb65d020947a7102ef0c67
SHA1f8328d6e53898c46f90918a9106a850bcc62ee14
SHA2569354658ef95bb0d84c9e2d6916699de422c157c84ba88bc64db68bd995d52a8e
SHA5126abf3513842036a571ede795c12e29c878f4cfea411b92dce6177cf7047c4a28dd4b84b02ec27b0c1f714e303c2bda4d346b67cd325c29cd6dc4d9b4a70ccdc9
-
C:\Users\Admin\AppData\Local\Temp\CcAw.exeFilesize
191KB
MD5f75aaaff5f634894d96592c49073855d
SHA1f60b856ad1ca68a50fec0e47c36e9bea3ab32a2a
SHA2563da11a2447449c7f4a28f77d53d4c79b2ab7ab4dbf52f28bbda02a3aa31fd950
SHA512b7926720ad1a81dc0a5a03c1d5db7697f2a1e1a2c936168e516cc01e398686c4dcd9a997166a288a1ba13613615b64e143efd64cf85508129f81d738034834a0
-
C:\Users\Admin\AppData\Local\Temp\CcIY.exeFilesize
220KB
MD552715f1eeea12b58e6c374df1a3ead93
SHA15fc931e30a45c318d89e6078097f5ca738570ffa
SHA25616ad13e52da5a45d8e34c229904a16bed413739c54156a6ec53b6f5837da8e15
SHA512d956a94f8847e37ce67ba59662ee2fe293862616e07a280fb9f63004234750ef48c9f4ba135cf2ee1b899cb9edcf87c8779dca864b45adf7ff4a8e8c479cbfc8
-
C:\Users\Admin\AppData\Local\Temp\CcoW.exeFilesize
187KB
MD58f94cb81695b0f9de201184f8c73b6e3
SHA163a586516b0bb4be0ac6f58293b2facbfce86dd0
SHA256166c3da4411ece67f362388765e0dc1ac280162962b006874da258cc9b8034ab
SHA5121c5ec97824fbe155ec1cf58affe6dc2b1499cd8b0aff6915ed25a95ba5e6e3929b014df98cf71a82664a8bf94adda6fbb8499317c7680ce8939afbcc7d9f3445
-
C:\Users\Admin\AppData\Local\Temp\CkIE.exeFilesize
202KB
MD58aba047be8daccaeec9a2bc63c01fd4c
SHA1137a15b9499354aaefa80b4a83a39f88190ec33d
SHA256fe0cdfdc695c5c28f2a638d8bb0c79fee4b9a7d25e1ab9e6a7d342ed7151e389
SHA512d587f8d8fd8fdf1f090b027e20799642347ac22d28a4ea3f17cdbef70b3163d34365c64749e0a6d264ff933f8ebaa93f3fb36e627f3fd842027aece5c306cbb7
-
C:\Users\Admin\AppData\Local\Temp\Ckom.exeFilesize
189KB
MD56a516b6d676129b825668edee3ea8729
SHA13b3c63f647e1a366d0bb5c3d66983d30d79d44f5
SHA256783fa39a97a48437b7033e04541728ad017e1b3fb27371421798d8310baa8031
SHA512e06aa61e1cc833a339a8784fce8567470614d727fc61f929176e33128aea79b374aa8cd6cdb00225058b26a9e954095ca84ed52145dbf7db233c5319ea6c9342
-
C:\Users\Admin\AppData\Local\Temp\EAQU.exeFilesize
668KB
MD5f41872010870b442079f853e7db84765
SHA1777a57f45f133be3300b222ba366636dc3a5fb30
SHA256892114ab89678e494f929c87061496ee409178afe60d4bdc299e68a17c27e258
SHA512fde1fbd68dd30c0b527fa6fa709bb017267e3561e2dc15c5be9277c7182026133022744de87ddb699d135151083fe6ee734b127a94596f8ed3f8cc3928778924
-
C:\Users\Admin\AppData\Local\Temp\EMIC.exeFilesize
189KB
MD51c77c3f2fdeeae10b4e31d11df866d3e
SHA1c44c080837e6f54d6beaadd80fa8e85d332d1936
SHA2565340997dcd3dcb7debecd6fc143c4f79f1543589db2b1f525d955b7a67ab767f
SHA51286bc899afeee71613416f8ca2f571ad69ef323c18d6e70876845608dc61d4f4c0f1b688c9fa5a64ce41b7814bfc7be65e20ac5d098cb6faa724625a763201140
-
C:\Users\Admin\AppData\Local\Temp\EYgU.exeFilesize
804KB
MD5ca7f3623de19a84f19f0df9b06239d54
SHA1816ed2a82c909b582c9e80cdf6f66e685fd70d3d
SHA256d6f1c00d140689d2fee241506992004a518911caf02be6be02b6ee534789b4cd
SHA51227c52bf217b65a3f52ff65e28455409c88505804ed9d07100fb4d6a8b4388e889d9001818d2612dc2b5ad2a46112bcb45cef4ccca22bef6d68ed551c1ea26006
-
C:\Users\Admin\AppData\Local\Temp\Eccs.exeFilesize
312KB
MD589222be1a68fa352f3f15fe948a63c12
SHA16954db91005eb8d0f0614741c030b2179167aee7
SHA2563523a1a14f4c153873848d2b0a191ae0c5da35cf0c3175c6b779f7a88216da6c
SHA5126a123798ecfab5218fe7071c887e5e6e2065158c5eeb15b968a8bc7d0483eba7b6ee63a2160b69b683a05807570293996ac5493ca32fb63bc984810a43101c75
-
C:\Users\Admin\AppData\Local\Temp\EkEO.exeFilesize
315KB
MD5cd1f23d3d33f94a7d443bd9a03a9f5b3
SHA14f0a0d6009ef85d7028a86838f120053f7a7625b
SHA256e21851b4f99834390704c22ece49ea0c57166e5e9665bb05c17947093ba04564
SHA5120e2853c6f43f6e907113d0d19dfebdc10774415bc2b8e5826d0c290ea0ba00c937249ae0ee6c0f8542afef9e80be206b9d8e555a0bb35526db3125af6a32c591
-
C:\Users\Admin\AppData\Local\Temp\GMIo.exeFilesize
5.9MB
MD5ff8329a406d0947bc58da7469e7fd1b9
SHA11f6df7706ed0503b4a5aeef95ac8bfc3f68a44a7
SHA2562d2a880758c817236dc8a122a833599a723f4b2ddc6c22e10cec53ffaaf2cfbb
SHA5128bbbc5de616d9815e9d77de57094f218a6a785c90d1ed29bd21d747a9d1685e70fcd8a8c620fef3c367202ec6e42744cb1ac9abac0bdfaf35e384ae7c999d566
-
C:\Users\Admin\AppData\Local\Temp\GMko.exeFilesize
203KB
MD5f937c60aebf25bcabc73b2779bb90561
SHA1bd0d8eb65bb96da11317709ec9f354cc9f260ead
SHA25689b29a2d4130ca9714041b1b7e05e0c1f4a143de1aae5fd652e3589f04c3d258
SHA51212d6890392e5c0d732953425ae21d453c9f714cd5a68f72ba20d37c643b02e24bd79d28ed4c51fc5672308fdb000d5eaa4fce55be601d139071f751ef0ef2b4c
-
C:\Users\Admin\AppData\Local\Temp\GMws.exeFilesize
195KB
MD54f926fb85a611e9ce277a87863140cd1
SHA167d63149cc6025c4ac02ffe2bcc27258e9cf4a54
SHA256ac56feae399040a30465e3206a01b9c6334f284ef41b42debf8816298458ffd3
SHA512a1594e9d83e27c9c5a3077ad855a3e3a1d233f6344dd4522f75eab3cecd1775e5c8c04c72cffb98b8d5950dad7e3b1f072f10664171625bd3c9109517f291c97
-
C:\Users\Admin\AppData\Local\Temp\GUEy.exeFilesize
262KB
MD5bbbee53b14e5974ba4406321f5b554a0
SHA13ebf770163504e00020be5c07602583dcf2bffb2
SHA25606811ba51cae0db638d8f73ac52812549179579bb64339c476ebfafe5b02caaa
SHA512e62cf3ac968a7c23898679e2ca9014c0ff23948cb1b7698575b1c77255c631896447faeee4d8c22210d4973420e02e649e1c1d97ede94ec45ec18705ee78fdfe
-
C:\Users\Admin\AppData\Local\Temp\GgAY.exeFilesize
183KB
MD5c31643f65e785aaa75168741bf21bfa8
SHA17795d2a80368e08a12f202fecd109393b67119d0
SHA256910d8e540c1f43ede61cebf7fce598c569c9228be3680647b885979d11000187
SHA5123f9b3df4499a8099bfbe3fce9161154edbfeb17b2ef9658ee566b4235c78ac81b60d5d2567509ac5cb9a2f132a56da4b85ce327c0995339dcfacf97f30f69582
-
C:\Users\Admin\AppData\Local\Temp\IAgw.exeFilesize
202KB
MD5a61c492cc83a44833d85ab44060d3820
SHA1215c1400b3b8d9eade7bd789809dea32a0dea41d
SHA25688d0b9d9fb1c4193254a9288aa0061cab4f752efaf5285294edbfd346585081e
SHA5126e6a50f3995624501506a84e2b06adcd594631f959254b96f83fce90c1093df7a3c6d84cff9ed00b45b301cf5a2f676a8345e0f9d6c6a61a210e3e0ac9d44b66
-
C:\Users\Admin\AppData\Local\Temp\IMQU.exeFilesize
180KB
MD5e22d910b8c63d15034e2081357c3188b
SHA1190f9ff7cd3d3ad26f8fd0b327b3a8522a96870d
SHA256157f50fdb38b609ba28bcf7c396414fc8fe9273530d113dda1dc425d73b4b380
SHA512d16ae789b47aae9d2f3e6f35777ca4a086bb06bed5a255d31f682a9346d3f425bfce43427e44c296453f181bc574767758a8b2fea1079b036a94c192d1f54df0
-
C:\Users\Admin\AppData\Local\Temp\IMcy.exeFilesize
189KB
MD5ef4d5a9a04159d6786fd261435917b30
SHA1aba00eb1a2647331b4accc0677f8595e69873de9
SHA256386133dc2b2307e67345ae4dd43f97680abcfbfe1d111ee25a624cfbb14f86fc
SHA5126f855bf61552e7574916b7d03f90b4930bef01015db9d65a6c71a8df4b9ec5c938e4da9d2d8575b9594ed0cc95c8c73e9d7c397e91b90bf6741448ccee0f3c84
-
C:\Users\Admin\AppData\Local\Temp\IUoO.icoFilesize
4KB
MD56edd371bd7a23ec01c6a00d53f8723d1
SHA17b649ce267a19686d2d07a6c3ee2ca852a549ee6
SHA2560b945cd858463198a2319799f721202efb88f1b7273bc3726206f0bb272802f7
SHA51265ccc2a9bdb09cac3293ea8ef68a2e63b30af122d1e4953ee5dc0db7250e56bcca0eb2b78809dbdedef0884fbac51416fc5b9420cb5d02d4d199573e25c1e1f8
-
C:\Users\Admin\AppData\Local\Temp\IgcG.exeFilesize
596KB
MD52ab629c79dd27d8d9ec7927bd97f7816
SHA16df496b9811202e2cfc5524049ccb33dac7bdc4a
SHA25679a923ec3cff46d16b8c298f481e4ce6f78cd3d64ca8c0b749be4141c5329d88
SHA51274cb2ef4d4d60808a74bf6d6f32ae1259afbe7fcda5703fd66a06148c5a19e766303549a3ebbe9bd8d02e08c911faf157301b2bcac57b161278e9545284725d9
-
C:\Users\Admin\AppData\Local\Temp\Igca.exeFilesize
224KB
MD5268a184bf4c47542d968ea707bb81c9c
SHA104dd2f6bbaa7c9af2eab892b8cfa373321381472
SHA256596cb15c6db14d30adee8090bc952964507eb782a7cde49deef8fca9f104604b
SHA5122f82a8b09cb65a0f2c4b3f8e266e9e0e2f884342bafde542f8ecef789c1fbbb4cc4195c7f213f8938f41fc81b4a820f87f39f22d6b9a5986b0d2cd5a125e49e8
-
C:\Users\Admin\AppData\Local\Temp\IkYe.exeFilesize
575KB
MD5774cf0eb300b23b4892ebe1ee5c21e04
SHA1c3a16660f0a1ab672d5b1ab40a5a9ab53d23d0df
SHA2566f3f8f581eb01581fdae902154a4c80f059fa3157c177b1d06dc4f6bc22c452d
SHA5120debae0e12300e4e0c06a1c37a80a6e02b0f5d1926fe8b0a46a1cfb8571cbe867fc819ed362c287895d5fa89d0e510b635f10f38c847a7d718f15c04e1c4084a
-
C:\Users\Admin\AppData\Local\Temp\Ikgy.exeFilesize
205KB
MD52f50cb569dcb7b6ecabeeab0a94b06ff
SHA1c47d52aa21b1230cb1b2e2dd2641b7d908955fa3
SHA2569570dd5c086c2a61b7cb82f6cd558b9568f6dd2a5ce042d032b5fd8c0f57f20b
SHA512f14379fa969bf98ab8fb7d174d3ded06a6d44c6ad35fc563a072e7f54e035e8f1b3addbdc790284d30a5f480f2322d4ddde0d9c3e3e4c1f7fcf9fabb34ea34e4
-
C:\Users\Admin\AppData\Local\Temp\Iosy.exeFilesize
191KB
MD56df805685a2fc50734497d3af41e5897
SHA17c02781227722a8506d1cbde836104e2fe71cb90
SHA25651a44d0786419a3425229931c81f667055b93d57143d988a0e57c943ee22f4c1
SHA5124bbff4af9edeed9c37de587a25eb187636e6f629a905997ef12f6c71a0c8f6181b892265d8414087ae2449f164214961c71c6c8346760cbe4d8e21cb95c5ff3b
-
C:\Users\Admin\AppData\Local\Temp\IwkE.exeFilesize
319KB
MD5832e998207af6d624b7b313485b7308b
SHA1c333964b764986597b128c994d23d4234712e167
SHA25662cfa0288fee62e4e848dd62b60dedd0b9ea79e37084b7c89108418568ddd050
SHA512cf3aac0067710c464a87acc2415a6d99d5b7ad2e2f189737089b63af2ef4eb9210b5ec58141924cbfa9ed43e8cf51a1b0c9b5cdcb534936145127709c4e1f3a8
-
C:\Users\Admin\AppData\Local\Temp\KMws.exeFilesize
201KB
MD567d6ccd49093dc85b0006ee529eb0e1a
SHA1a27c3b5870bf36cc6a7b3fc8e32fdde36f067cc0
SHA25614f05c811c13e05db2bda3dbcc2ed6a4b447ccce113417ddba5052437256c698
SHA5129c91b0826074a87525ce9fc7cd1bb2ebee15cdfed97f552dbd97a90c867dc968b5b0b5ed3b7b789ea11aee8ae957318031e94a24c8fa38ef6af0489cd9ee7d88
-
C:\Users\Admin\AppData\Local\Temp\Kgwo.exeFilesize
193KB
MD5036df62b1dd219eede5d415d42438d9a
SHA1a3aa231d721a65cac9052f0295745aff3107893d
SHA256e350444d847253f25fd51d22c31bc7fcb5bbafacd66606cd8dca9ac406675929
SHA5123292098ab597ec02c7b2675d74701b0326d307aea02e4fe3d15a8730cf37fd413be1f337bcc1cf0a4f7c71b1b22c934cd5659ff9c76453f7d934739f83bba802
-
C:\Users\Admin\AppData\Local\Temp\KscS.exeFilesize
185KB
MD5751b18f1fe3d728941d128626ba7f1e7
SHA123cadfc77248941bfd71b8152c232026b9aa44ad
SHA2566bcef411f5e3fdb3b6cdcf46a9dd70606ead8e78a8f4a737c0aa826be12883e5
SHA5120fb23540375c14c8504f54b0727c0058fa670f10c6bae74de4d735fd87cb728a9560c57bc1784d83a01fee475af5b4264e918810495e582b556dd7b28e562f58
-
C:\Users\Admin\AppData\Local\Temp\MMka.exeFilesize
191KB
MD5a517af250ba9cb45867dc40dca10dd93
SHA1ca247568ee6ab08bf1a1d8ed2ef54977375b1263
SHA256f278c5082210f34e36d80902121d73ae93a13abf94b422da122db0b156baf125
SHA51260302ab28eaf21d7e5ed330bde541f1a9485cd905185e64fffe0cdd9f993e43ae8010663eec3d535aac048a83bcd37ed88eeb81a3b45bd2e27be20336d7da11d
-
C:\Users\Admin\AppData\Local\Temp\MkMg.exeFilesize
200KB
MD536c4c8c0f9d973513dc2ac7bb9cde2c8
SHA173f892283a271bf47079b20d8f9d2d719047d087
SHA256d9c7211718934767ae53fa2ca142d3d8362b28e3dde155b06f9a12a879334f5b
SHA512b7199372008ed67dad46108a2fe9afa424f20a364a7536d2f3e07e247164ccb49d62858fef25a4e4dbfaf829bca6d0c1b9d6213885e2f4b48395710630b2d1c6
-
C:\Users\Admin\AppData\Local\Temp\OgES.icoFilesize
4KB
MD5ac4b56cc5c5e71c3bb226181418fd891
SHA1e62149df7a7d31a7777cae68822e4d0eaba2199d
SHA256701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
SHA512a8136ef9245c8a03a155d831ed9b9d5b126f160cdf3da3214850305d726d5d511145e0c83b817ca1ac7b10abccb47729624867d48fede0c46da06f4ac50cf998
-
C:\Users\Admin\AppData\Local\Temp\QYMW.icoFilesize
4KB
MD5c7fffc3e71c7197b5f9daaea510aac10
SHA123262fb8038c093ac32d6a34effbede5de5e880d
SHA25671254090503179540435a1283d04301f3d5ba48855ae8c361d4ac86e3abd2865
SHA512c3cefdb76a9fc74299a7042096a549e019db3f2cf79e81deeabab2f3ebf2bbc9f2924a84cbbbc4848a4bf84cc3a0886c6c738c6bb37c9140dfc57f1f797e9c1c
-
C:\Users\Admin\AppData\Local\Temp\QYcW.exeFilesize
195KB
MD5b77975605eb6cc946228633dcce56b43
SHA1fa208a2a460345ed9f1af7f171355b607280e538
SHA25650fce5df225a49abaa60d5d4a6c013fea17e615ac50fab04d7c0e38a6b37d9e3
SHA512fe01e43c63465c44c339aa6515dec22f9219ffa3da8ae13080a3cff22283dc9455f5effb42dd3caf3954d5e72e82aa90210da0f82dd86e1285bfaabbb264c5e7
-
C:\Users\Admin\AppData\Local\Temp\QoMG.exeFilesize
1.1MB
MD5b2466e55b16213985cba6698fe6b85c4
SHA19bd1d1952c06c9ecf279413ec69f9adfa574c55a
SHA25688b6d41b15c9548f50292fc29ce9c374cdd728dcd4a43f4332be6909d99bfb78
SHA51281c1561368ba6cb707418a5fe7d0640fe6a843e911d7ea1fcf31ac34740204917da178a93f1fe12f22fdca44e1985d66b2b5d794f9aca9f09a3f3b84ded45326
-
C:\Users\Admin\AppData\Local\Temp\SIAc.exeFilesize
1.3MB
MD5e35fc7244f9ab9818dd337c1288f2e3c
SHA1e835f701e943b6c231cd0e99c6bd7ee484f6c671
SHA256d1188807fe92c80bc9415a478fd7aa47c99f16799bb641b106934668fd16dd41
SHA512d3eadc755370f9dd2f0db3e7f4765dabc93604baa5ba9bf87421a83fce673128f44cec62e11d5d684ba730ffd481fbdd63d83942a1bce0c8c9d148fe0c2e7ae0
-
C:\Users\Admin\AppData\Local\Temp\SIoi.exeFilesize
201KB
MD57fd1dbe79d5f9ff8a3ba7a068b647400
SHA1382a8a83a2e35fe31748e39a8cc2f8f2eacf946a
SHA25640aad1babb64815bc3b90ac4d185b8ef0e6f970e5084d79224762c5de160ae7a
SHA5126f00d064157fe8fb3f6b1256cf3493d0c6d93a74c03e815aed24d319fd786f740f585c02000d5c59feebdddeca634ca2ca7a18086915de10549eb9a49d10649e
-
C:\Users\Admin\AppData\Local\Temp\ScAw.exeFilesize
1.8MB
MD5bf786497d1cbf27e1181aa944142cf3b
SHA13567284e067ecdfcee6d1c2a824a940d78ce816c
SHA2568f49f0eab132a839fc4cf5d54d634b77a35e50674ca82cb6a3871b0bcfc5075f
SHA512adb63601a25720f4b71b8f97aa16c9c9dbac74aac996920970a79a5a6a66d9727f5345e791dcdd753620fd397d71349f8406dc5795a5a1d0298a7230fb5abffd
-
C:\Users\Admin\AppData\Local\Temp\Scwe.exeFilesize
424KB
MD5fc080a31dad3e01f3d236f435ba1f37e
SHA113da99edd3e3221010bd0d1ae3dff1f8ddd98f66
SHA25642c7f03c6299cc7d087db17c445892246af6fd704e067fbd239c9aa6eeb8c0b8
SHA5124821dec9363aeaca8deff29b07dc9505011f2e1ecae70686485abf9cdda960fa33ddf03158a5c647014690c5e0b9508d029e48d2619478ccae6a9a916521d3a6
-
C:\Users\Admin\AppData\Local\Temp\TWgMQMYo.batFilesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\UEcA.exeFilesize
638KB
MD59288557ff6f5ad3868c46a7e0fe3ba15
SHA1bfe6826f02de1cf33456b646b70158af6a486e9f
SHA256fa7e234341aeb424f0e73a82ae13721a09e66332c3b3597a3a64ba0ee4c329b5
SHA5125504c574172511d0a15eb2ae76771bc95c1de73975954df8a5912783165b0cca2b7005dd50cd6c1383a3774752463bd7dc026a8c468cbf65e11a14747ba10e64
-
C:\Users\Admin\AppData\Local\Temp\UcUG.exeFilesize
1000KB
MD5f0a3673efd954228162bbf0e7eaa59dc
SHA1db63665941bd2b91268e25e99281bf05fa3eec2d
SHA256d7682ae49b050557eaa26c332ffe0c4df5d4a2ec52baa6a60dbb0ba83141e96f
SHA5129f2fbb0a6e701ea89bac282d427d30d85e725533357f272e6872908d869221197ab48a4c75f8a78940530b746a5981addecc05ec370c502c2ec48dc39cea3c1a
-
C:\Users\Admin\AppData\Local\Temp\UgcU.exeFilesize
195KB
MD586fd80e3ffa03eaee77da69961a7aaae
SHA16a09e12cf99d06ef6b8036aaa340a61a40a31899
SHA256a24aa1d0ccff88b2c00bd9d505e0e5f74b829af9d8aaa32a8e73e4f654b6dda0
SHA51249c6648e6bc77da13fbc97e637edb4d6057bad5e197a1c3f1d6df43d27a4dc2b329205e1c12d8c05f7dd57a64a6f7b13572dad5120dcb9d7b857a8f2af39da78
-
C:\Users\Admin\AppData\Local\Temp\UooS.exeFilesize
200KB
MD535d8997a971fc13ea9615b9192b444c2
SHA198a3dabb45dd65bd906ec723d37f04ae0b4ca36c
SHA2568c0c8ab02fd1938ba7ef42af919d1b66677adc31f29093ec15cb8b854f56eaa8
SHA5121043043126732d478134f4ceca992d6be8480a1c0e05e59d56c525ef9417599a8e411c20b697a1459ac07b9fe5546a92d74461402de941e7ef312e560745e248
-
C:\Users\Admin\AppData\Local\Temp\WcwK.exeFilesize
498KB
MD5e6159ae42549083b7ea224e41a2b19a2
SHA1397a3f0233144fec03af9bc36f620014e9e52271
SHA25668bbf0488adb1d8d4aa1f51a9947403ba090bf2bc7b9f15bca2ec80939c51dd1
SHA512db6265b9d8e2037df991e321c4a45326c2b3dc790fb21b8ab932ecbb1f8679feb42a8b89e5ce5cc543a06c8260e292abeb33c38111114980e81340759c37c179
-
C:\Users\Admin\AppData\Local\Temp\YMQa.exeFilesize
228KB
MD5e34304f272abe7eff8e9728122d95bd6
SHA1de83038886795672a389c0e9fc74384ea0caee31
SHA256f4c2cb45659491b6ba17cd46c65ce0cb123cbf9097b6e08a3ab640edbd880be5
SHA51231bad0919f326700ead9f12f0675c303a23e47e5e1d28b9d4e83fe06ef13a9b130f40fe468e91e61dcdc3e04a2571481b703c5e037beb8c970f0cf90125cd70d
-
C:\Users\Admin\AppData\Local\Temp\aQUU.exeFilesize
550KB
MD5edd1aabe9a77e53141df7c9ed99b1598
SHA1a1f37cc2b90a6133c1444d6a0bd3dda824f236c4
SHA256522c198b1bc8fde9780bd6c2194fc6a83d2004999879089ec73d411905e2b948
SHA512f9c0bc71e85cb3c8897760db2187c7dc4a048fd8533e6a1f2715a6513075e99ee82e161a4f320fe6ed183d3a3560ffb1edb07dd09c61dea190b45c6ca7aa99c7
-
C:\Users\Admin\AppData\Local\Temp\aYAM.exeFilesize
680KB
MD5d7488e941c9633dfc582c4c4ffd17dc2
SHA16bb124d25292a3e42a8cc81cbc8b6f8e2a9bc939
SHA25612aaadecd5a82d41eab8812257eff806182c19661e52b0334194c227929fadb8
SHA51278d7ebb6286616377e76f1b869bfd8afae9893a12d3cd5b9fdf19d269be8fe5123721253b944ec0e78859324d4cc9804a8d4cad3ad54881bb5327e4809c49ab5
-
C:\Users\Admin\AppData\Local\Temp\cEUU.exeFilesize
194KB
MD5422121cad569c14d5888e2b7b8c85d17
SHA149a160e7b8cafce12599186ed0d4318e41533cb5
SHA2565c84140ca00b080ff10979a3a4b8dcc88861d823f9dd0705f4d5af97529a8f6b
SHA5123291fb8d766db0041a05d4bc52aa91bb652a143c1c6b654c838fe976b5d1d0b8849e97defa90fa6c9b6b16f17574029040e1b4314d806d5fa8b83bffdacb4fd6
-
C:\Users\Admin\AppData\Local\Temp\cQIc.exeFilesize
186KB
MD5b80a8d72f4af0b69690b2edc5ac2e5fe
SHA1ae08680e46e3156185fea6ae2a86353e03b23b68
SHA2562650ce8a4ca41155de8581aa26641fc2a6dda8d131409c9e7757c88cef16a34b
SHA512d02abfa9691d74c25132285a02c6d89ffb2af74fc046fdfee7ced9fb61d4933d8c6f7ece6a3af84176678f7a10ca73fd1bb71e1c32495a273721938954762753
-
C:\Users\Admin\AppData\Local\Temp\ckQO.exeFilesize
198KB
MD586bde56923b8cf89318a28f394c49a01
SHA1a4f68e4ac3a5d415897150c6e0165ade3e8f9a9b
SHA256b18ebbae567281bd926968b121e946c706ff49bb39c2969d738e6aa31a9945e6
SHA5122cc8dc1fb8fbf719b855ceec3f14c99596b3f244513f31875c9c8447622fd26b1575def68cabfaf14a5a1c111d2fa8615e5e4eedefa976abd2f50a74cc40e036
-
C:\Users\Admin\AppData\Local\Temp\eAIW.exeFilesize
792KB
MD52e244305ce0a8692cd938db69fd40019
SHA12755fd633eb0a618c52a67373d2a825753f4fe7e
SHA256f9bfd67549938a59424ae4e7536d2100a66913cdbaefb3dae3d2d2739ab0028b
SHA5125757aa82ad482f4b84223b2c61dad0ebd1886c1e8aeb1807ab268570a67b8b8504af42428fd79e711be970814adb85cd166d646dcdd001a60e6e448fbbc93412
-
C:\Users\Admin\AppData\Local\Temp\eEYi.exeFilesize
199KB
MD566792d7cd94151a0df4bbaa76b0bbf40
SHA1bcc22d587cbcbf83cfe7207916234701fa60e298
SHA256a0ebacc9e40fde33631b5874b407de2c9558d57acd32581e0e124d311a07bb95
SHA51270d440c80d8281fb3f9a717d7e910d4142c501aa09a731a5c6f4c22060ca132c46bc81f0ebf9d0a8db71ba2dbcb42ac1ec023a1e5fb8010016e25194093b3b02
-
C:\Users\Admin\AppData\Local\Temp\eMcu.exeFilesize
646KB
MD5bf14188a77f783030e87c28b74f4dd14
SHA1da20aa6b4da21b559a1c8f42ad3acc64101f73f2
SHA25664d644049c8608b880fb7e1b5a67c00349c4e5f3eea33dd2e1f5b8adc5382b60
SHA512ecbc1bb1b58c9befb50c987f5164e6fa2368c874ad6c9addb4732e9b6c45c1c450824135e353882a69230b1d3f140e66551b529649613e5138d918020dd0ed9f
-
C:\Users\Admin\AppData\Local\Temp\eUQo.exeFilesize
190KB
MD5ee315860a0c21a6c63f451a756bb7fcb
SHA1c2f61f3ba8644fe20d13d4af268f82ea70e044c3
SHA256c3e35ed080117ef043c89653fc429bc04260a0b94055e67909273bfc429485d5
SHA512c931b2481c4ce455916475e491e26083c4a0ef1b954e0b2ee40eed49c20b3ecc34ec583890d72e68cd63c3c9c6a1a3760f02bc601d77826b8e0f0919e9829c8c
-
C:\Users\Admin\AppData\Local\Temp\egMK.exeFilesize
185KB
MD5377e8c0eb9e0b3489162c350a7f95a40
SHA1bdb923120b5da47f08aa527aa4393c4ecf469e01
SHA256753a02e5b115c3c246b260e468fa9537f873db26c420e3baa1860fa2263e85e1
SHA5125bb95309630c3b02592e38046d93630a56081de12e34bed1844f0fc17fbf7119c8a31f905d119ff37a7d529534220af0a8da0e113ed1c1af43e504da3b8cd1a4
-
C:\Users\Admin\AppData\Local\Temp\esgo.icoFilesize
4KB
MD5ace522945d3d0ff3b6d96abef56e1427
SHA1d71140c9657fd1b0d6e4ab8484b6cfe544616201
SHA256daa05353be57bb7c4de23a63af8aac3f0c45fba8c1b40acac53e33240fbc25cd
SHA5128e9c55fa909ff0222024218ff334fd6f3115eccc05c7224f8c63aa9e6f765ff4e90c43f26a7d8855a8a3c9b4183bd9919cb854b448c4055e9b98acef1186d83e
-
C:\Users\Admin\AppData\Local\Temp\esoi.exeFilesize
191KB
MD53ea7146a95987b558a4b2756082dd4dc
SHA1879f9cdbf5e252ac6e1c8559246802d2fcf91141
SHA256c63d574d435b16eeeca233c68e70bd7aa870b0eb09ca18c20c80ad1ad1233606
SHA5126df0dd89cd7b1e22fffd93dc928ef850dc1a74f810caf0358ce9eb406d3e0ed92ff4d320c2842ba870a087a630c959f725323ed4c07e21fc1668a2a287dc4483
-
C:\Users\Admin\AppData\Local\Temp\file.vbsFilesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\ggQU.exeFilesize
186KB
MD5a73c6922b5ed7237ecd5947ced97c71d
SHA119d32e127a226127dc5ae0acd65b3cb4ac73aac5
SHA256ee5cd219bda4963b1442d6395d4e8cc0750407177f9fb3a8a9a82ef117c028b0
SHA5124abbee1958a5d4b7bda55a20d32033f611b5674cbd4186bfbbfb711d12e66664b72be31c30990b4efa0f7e2279158ffb827584388fdb89f4f7523b805902a2c5
-
C:\Users\Admin\AppData\Local\Temp\gogO.exeFilesize
5.9MB
MD56a66607c5c6263625875b12bba96387e
SHA17a1a81edd17b98895c62e359646a6497786a88ba
SHA2567008784772d61009d48fe61ab288d66bd15c19ed78cd4cc7051482f4feff4269
SHA512c9c4a0c95fefe94e9ad3e81f79265cf3c0331a6d250266fc5cc73beda7558b7ace6d349d2b6b2f3ffb2df4838cd84bb61ade0c25efd845ddb980d25bc0619273
-
C:\Users\Admin\AppData\Local\Temp\gwcQ.icoFilesize
4KB
MD5ee421bd295eb1a0d8c54f8586ccb18fa
SHA1bc06850f3112289fce374241f7e9aff0a70ecb2f
SHA25657e72b9591e318a17feb74efa1262e9222814ad872437094734295700f669563
SHA512dfd36dff3742f39858e4a3e781e756f6d8480caa33b715ad1a8293f6ef436cdc84c3d26428230cdac8651c1ee7947b0e5bb3ac1e32c0b7bbb2bfed81375b5897
-
C:\Users\Admin\AppData\Local\Temp\iQka.icoFilesize
4KB
MD5f31b7f660ecbc5e170657187cedd7942
SHA142f5efe966968c2b1f92fadd7c85863956014fb4
SHA256684e75b6fdb9a7203e03c630a66a3710ace32aa78581311ba38e3f26737feae6
SHA51262787378cea556d2f13cd567ae8407a596139943af4405e8def302d62f64e19edb258dce44429162ac78b7cfc2260915c93ff6b114b0f910d8d64bf61bdd0462
-
C:\Users\Admin\AppData\Local\Temp\iUEw.exeFilesize
182KB
MD5f3fed0feaa9532e9e3352fa8ab7c0a48
SHA161dc3fd3938d1e0a93cf5e438079b7c04bf873e1
SHA256653c81db91aabe5fd198e3488e7064b3a0c28cd3f52f1b34a8c5f96139731499
SHA5129ff1baf546c98eb274b19ece134dbe9f1f4a481dd9cf73d1c740785a47d782ef82ad3a629dfdb447bdc9e2e6ce43f135b8051d9d7cc48c62c3767bf2615e303e
-
C:\Users\Admin\AppData\Local\Temp\iYME.exeFilesize
804KB
MD50f6f086d86d91782b949811da23bfdef
SHA196610e8a3129257d6d3e546cba9876674b9ec174
SHA256d57b9cada7c1856b7aa9e735451be83686febc5897c6b7f8e864b0caac58a185
SHA512cc3decb94a983f822d453d0433fe5a0cbc2920b32974f13441818f3d4d3efdaabe274d712232c6ce0d6b28e1898a092b25cee44c17ec3b7a8dad3db3b6c800a2
-
C:\Users\Admin\AppData\Local\Temp\iowo.exeFilesize
816KB
MD5eb84c8b4360f6cc88b845235e540ba68
SHA1265c40fbdce6110af88f9abf38546954e4228b01
SHA256d11af730708e4368b02dc79e1730356dde0a1441027a3921070a579201e596a8
SHA512c5ba889beef673f1e728a753a27ed931986ddc8b946a275adf89c3a02b553e864a9c323b6fc2203461d059818f488e483d0b68a235ec1f26827915d8083648bf
-
C:\Users\Admin\AppData\Local\Temp\kAUM.exeFilesize
205KB
MD57aea964518ad9d64f9fc0498537eada5
SHA17eaa238edff2fe434b377fa09849685e0520071b
SHA2560c667942252317b7c083582762f5ff64407febb7eb4004f32fb281b93af6f7c4
SHA5121636fff0c074cb12060bf57b7e564404ea3421b360e1c7a2f0a5c5d0fc335a2ea96d01f07487101a969a86fbb4f87edbc92918a4f92a730d3219bea85bb89484
-
C:\Users\Admin\AppData\Local\Temp\kUgk.exeFilesize
221KB
MD5f9878a2f434a7ebb29a9e59b2e8718d8
SHA1d0840a8eb3dbadbeb68cc8baf5cd7e8592bb1f3b
SHA25673e1a05aa363526587d2641e88d2ab435915517706cbd503af5771b87152caf3
SHA51252b7600275eafb769f438daf448a2f7dd338d0bcac08590b9c212fa40d92e21d68305833e02ad841d2469f0e7d317dfe1ba5c9d3ee517df7387b8a48ac1285dd
-
C:\Users\Admin\AppData\Local\Temp\kggk.exeFilesize
202KB
MD54bdb284f020715e7e4da5edb7d435491
SHA11f3f4aa29e8458e3f1f4b0acf960bfcc9f52026e
SHA2562623182cb97c0df7a9b400181ac35ae59eba68b69400b5055cdf24809bef6691
SHA5129b3040e18f2ee87b86e8c62b1bd4b02425f40e5d81380466f8d294b361a72c39759ed8f86f6bb9c1464c3f9bd9cbee7a741862b4d7f49d0ce9398cbeb82730c7
-
C:\Users\Admin\AppData\Local\Temp\kgkq.exeFilesize
205KB
MD51d00d59f20059c83de52c85c37ecd790
SHA16fe7efb942ac4613403ba963497e7ab27343f695
SHA2569de460127c303381533d9b7715e981ce35c3e80ecb8e6d040f8c606eb26ff4c9
SHA512fd7e781d47f957d2bad6a93dd11d25b2256a9d93391bd9b18df30076f67410140bc58e23a3446cd35a1fee338327566ea0b5b256a040db26fd9582a44d409122
-
C:\Users\Admin\AppData\Local\Temp\kkUi.exeFilesize
187KB
MD527475e7f5d6fc7384263bf166e071d18
SHA17ab1ea86eb2badc5633e8dd4659d1230fe18f213
SHA25636401a06f530c4bf352e717fd2356dd524faf491713bcfe6a0d522711754ff2c
SHA51284d5dabd6aa8fd0e91148edc35933afcfd27016882776a212452811af500000fa75f6f6ec7b398b3de14c9114e67d31d84428bcdacf2171e6c3640cf8f18d191
-
C:\Users\Admin\AppData\Local\Temp\kwcC.exeFilesize
183KB
MD57ee5ee0c0599d5f3ef1ef79fdeb671c0
SHA15aa7127ddb7effc26d7b01b301c965ec863316b4
SHA2561df85c56729b550c4f3df7093b6fdc36832bb180a4bd65e0f687f4aa430f341c
SHA5122222e97f361bdfc4d389ea662226da5dba70df7dbce5283c6b445155a37b50e539973caa6f34159202f2f60c3b89fa347436334ac02505f02cd8a715c4128ffd
-
C:\Users\Admin\AppData\Local\Temp\mAUK.exeFilesize
825KB
MD59eeeba38a6ad1c6b06e01ea67c556363
SHA110fed0b28e2673ebd2a41f198b79824e1009f714
SHA256e26dbabfe1a305661c2a7422db63647cf38080a280867eafbdec29809b3fa891
SHA5123b4e86a724a2e7642e3c6b4abf43f46741055fa4b05f070117e0829686a53a836ba8afe6f722b35323e6b9a27d2af3283e59a13c06ae0719c44305780997f024
-
C:\Users\Admin\AppData\Local\Temp\mIcC.exeFilesize
770KB
MD562c01e93a3f094a7ddb42e3b7a83f7c8
SHA167e12193178b455c1f0500391959719744608d60
SHA256e9ead0e04a0c3f56ba532d7018a34dbb198bb3f8593f5683e41df940dfe9cf4e
SHA51255c865ae74f53b7f1870e87f407a46f8b2c20458ed381ec26ab9ef529ab28e31715ea9d315c182dfcd8a0bc3aa6e24d453fdeb77ac93cca0f8740f04ce13c6d8
-
C:\Users\Admin\AppData\Local\Temp\mMIY.exeFilesize
563KB
MD54c880a4e29ac37ed9f04918e53aa0f40
SHA118f5cf685a1e76706aebd445777c40883f78fc07
SHA2567bec4b2d34e4e7a880b57998e478531414c95d225d9063370e33796a1badbdfd
SHA5127ea093e0fd07209a91c48156de35612c57efe5ff40cdad67521fc42b3b13ecee10717c94046b3a2c9f5a2a673123e153dc2028a2d3f7df49406386f0e36d209b
-
C:\Users\Admin\AppData\Local\Temp\mUwq.exeFilesize
191KB
MD5666a0817b8e4a65f4305c95e58acde63
SHA1831b00c31e9a8dcaa6cfcd726515b10be09324c9
SHA256d68cade9ebef5e66ca608cc6cd6f848d0433fb4c6d7eae45fd2ca10215510e83
SHA5127c7c5fbe7558956660f4fbc11cd555ee9779d363acefc8e7ce145d982f0099cfad7c603b6decb4a88be2d4e542e2007a7d5eb3576e08814115f864ecf53f9356
-
C:\Users\Admin\AppData\Local\Temp\moES.exeFilesize
191KB
MD59cfe3da35c52cd74d52f52915cd734b8
SHA1cd8b1e4d41ecf67913103ca4559807baf1e019b5
SHA25674f8cb35e1920b229afe6ef5dafe3ff87dae9632620fb056bf1bf4dd6252371c
SHA5121dc029723442a864ee9099a42408fada7e7225a67e6b16e2a659c28c9e4282972fe3aa824c1fd5483b16ef683af708e8ca41672cadb7683d742a7eb100491038
-
C:\Users\Admin\AppData\Local\Temp\mogk.exeFilesize
192KB
MD509753567c44e62b88fe22e6433a2384f
SHA144f844a002e78072f0a4a389c5f6b7ad63b0a33e
SHA256a61ebd427eccc7cc564efca55535c2942dc8890bd34954f672f9032194e54607
SHA5120dcdb79dba0e9dd381432bdcf5ff8331bc4d4a8107dbe04553000d4ac1b5ea1e4a80c9b45fde5230307ab018e8c7b2931ef124aa1a5ef8775193de5d508a0eb8
-
C:\Users\Admin\AppData\Local\Temp\mssG.exeFilesize
196KB
MD5102da88d2145aea77bfd6c73c1fa62b5
SHA1f821bb6abe642a75d369a1ebc63e32a5e0aee81a
SHA25670cf5b94fcf35774df5846c3d80f7a34c302a61bfdf2aa5e9f2182d63d437ef8
SHA512993ad23542e36f7a36ff40f5f2d5843889eea0d8f5221241c605d90d2c6108854f3cd2024d8eb6cd67980866608ae1d4f030532228d36f39d021238d8f4a2cca
-
C:\Users\Admin\AppData\Local\Temp\mswQ.exeFilesize
388KB
MD531cd8c05fc1d01f64b386386d0692f2f
SHA1b119ab7bb680e5a393245cdbc8120ed297b03a37
SHA256cceec83d78322ecaa1f7c81919db7c412e3d913e6f205f93ec736c8db2bc75c5
SHA512840f835f32a252d688ef85291176d580ffe1e07fee92abaaafa00f5d13c5967bc37da86bb1b99920afbd2aa5a08c58a35a566bb4a5530708a28f1c0bc80f7c37
-
C:\Users\Admin\AppData\Local\Temp\mwAm.exeFilesize
197KB
MD55d671c5c93ab9a2aad507754a9e892f7
SHA1577c3fde4b53f6c3e00f8534d7669c3ab55d1718
SHA2562f84e7b7a5412f9605f5958e10804d444c8dc7fd7f147ab109cf1f8c760908f1
SHA512169d6deed172bf6e5ac3baf6b38d263330ffa4da5dbae3422a429b8c2fcf7f8c008bb75871801430846f854731b5d7c03ea7536fdd1889ea81277bae1d559307
-
C:\Users\Admin\AppData\Local\Temp\oQUy.exeFilesize
190KB
MD5a7eda127a28d7a8ceb88beff5a54cca5
SHA1b6a89857ad85ab7e750e8c57dcc2c261abaa52a0
SHA256906d612cbd12c301f3bf86009b6cb5b6ff9335c1cea0d247f9b9002332bf6dcb
SHA51206fcdbb81f9c6e677b5a71b21fa419926e6051bcbffb312b53d979b227ee5582f4fedf34651dc40d5d5742af916235c24e9f8f4e5fbf679e4958a9bff01e6ab8
-
C:\Users\Admin\AppData\Local\Temp\osca.exeFilesize
653KB
MD555af744c8a8c5b845b25446ada234175
SHA1a70fdfc60a759034b969ad5d02857ae79e681949
SHA256526856c932325673c9c41d97d159f24bca7489167af8e37cf49a469ab2a72903
SHA512d2ba76b27bc17aac882596171d41de37c62fd2c9b7f83f5d648c7f8a407a1163a4aeac167564e7920d0813ca882fd32061a93a7a16a999d8e7c46f9c1f0ab5d5
-
C:\Users\Admin\AppData\Local\Temp\qAge.exeFilesize
450KB
MD5661a1fe2f918858187e7f0493c4ac1b3
SHA1d7a077e29125a1e92f7050f57be1f0dc7acb6107
SHA256f13216fcacf9778b711d4279b5ba46c80401f30e26f9b8037836b03f51504795
SHA5121b157c2294b8ff5d1c72b4b40bb301141b80c9946233a837fe6df7f780a2b2dc063292f8d8361d80e1a6c817d97a3d372c2a4f1a8a1164e47a36755eafdee378
-
C:\Users\Admin\AppData\Local\Temp\qoQQ.exeFilesize
745KB
MD5aa8eb2f6818d2cbebd1f46a96e153de0
SHA134d8b62e10b5ada6a6979b1dc0accfa397bbb68c
SHA256026067453a7dddc4ea44d936103a0a7f871f7a02c0d48e4b49fd26780179e2b2
SHA51251f1e60d83caba1180c0aa9ff6fa53cb6dda2444381383c9f9e44e5c59cded4d975d2b4fde6ac7d108186b02c52ffc914d11b7e875ae946553b9447104e5af33
-
C:\Users\Admin\AppData\Local\Temp\qwYw.exeFilesize
206KB
MD515e710d07b27e78005c7af9c1b304796
SHA1d97c3be0192b53542e3754d9a630113256337e18
SHA25607a9a22418f38c5ca4db1428a701f9f114b31e1f3d142378b4daa52a81fa86d2
SHA51222bc12eca5940de2f7bd538af50b646ee3892a19f8b2647e012ddad98720dfcdf015d6a98cbe7305a0f9f64661a97536a1a2e1374cd30b737d62b5b5c050f6ba
-
C:\Users\Admin\AppData\Local\Temp\sMwM.exeFilesize
211KB
MD5d0eaac594cf68cba920c278c12874765
SHA1e1e271f3b99170c26066d8665f7f661c1b9dfd5f
SHA256b92a403623e8bb0f823e7713aba04ec37712d0fb4b2db3533137a6b8dc9b1bf1
SHA5121e77411965bae7aa6438624e2e12c58852e5e9ff18fc7db102c837682e3d2a9b3ded0fa13e3f91af43dd1f6d20a73593bfa81fc22714e9015ff4d0f3d3158da3
-
C:\Users\Admin\AppData\Local\Temp\sQoq.exeFilesize
183KB
MD548cb4379d87db993c74d80373cec9bd7
SHA1f760db23b50bb315bc0ee93a8cc9cf3ded2bd904
SHA256c375e88deeffda834c67bf2fd5b911f1f811ae7ab33ac65ebe80631c616c3de3
SHA5123634600aa13bc125a5dda1761075d7b2df6f2f3652b913ece311fe48ca252548ffeeed009566d1eb36180a34bc85ce5a8dc4cc8ad79bc16cc128b9a79612eff0
-
C:\Users\Admin\AppData\Local\Temp\sUwe.exeFilesize
650KB
MD5a9a6d7ff40559dc5bcd36ed6c66d15c3
SHA18fa3eaf0dda57d6a453a33d19c5af9379d849290
SHA2564fcdad3d522b91af934dc76f1603affe22d43ffdf4411992ac6d113178460fce
SHA5122d3e98206e3b03fbed457db99d807ab14b66a413d411ebdd63e5e5332194a15b6db8065e8caf2941110af2a6e9f11027449e96ca844883603c37ea77997ab62b
-
C:\Users\Admin\AppData\Local\Temp\sosC.exeFilesize
217KB
MD51bc27c13879189131bdc3d59248dca38
SHA14e14135cda47cd928151d7d40df50ded2b133170
SHA256d23c68004b0a211057bd1dcd573f3d2094aae844e1ea323d5dd10795ef95aee6
SHA512bf95c569dfc85eea8c73c3ae18998b1ea34879448bab1bfb8926ac2caf0167161f3478de1b3894f63e4e121cb19b2533677b04ced1f9b41a1b6db52c192608ca
-
C:\Users\Admin\AppData\Local\Temp\swMA.exeFilesize
202KB
MD57ac48bdc4e53c19249baac2e2b3dce7b
SHA1304cfd25885714c61d47964ee1a0e282ae671b7d
SHA256df28f9b00972ef9fd8dd5e39f7fb4020a64fb9000f481a75ba40de55d1d70e55
SHA512d4bcfc942595e7f31659ba787882d5894c2c783430666d467176598a30421686aa535f8477ef4f7e29d428bdf326f5de7377a2e57ce4ec1f814254c5f0b3fcf2
-
C:\Users\Admin\AppData\Local\Temp\uQkC.exeFilesize
720KB
MD5d0c4638a9e7074868ba1f22c81f7b8c6
SHA17cae2b778fd3bdefa94eb62e587dbccc427166c9
SHA256a167c5edb74cb678850c1492919e978ee1b607b4abaa97d349619f28f7dbdf74
SHA512166a162f6b71a385484c741330ae31f30bfccfbcaaae303f0cdb55fdd0e1220ad03fbbbf37e31f4d2887052749cbd5e30423b08d04f74f20d8b2d717bcc14e78
-
C:\Users\Admin\AppData\Local\Temp\uYUQ.exeFilesize
191KB
MD501a5bfaa85ee6cb3e188cf4cc2f58a42
SHA146f72beb13a8ae44b24cf873de254eabe33bc0a5
SHA256b88998e1fae58fdc4741a3449952aa84739da9dace30c90ec60f36d0f46429a5
SHA5124cf079191228a9d02de0e993b9920f59ac6d38148d55ac709009ee19c5b16060dd8c3dd29bd759d50283431b9d290342dac11f5ce93869f05b4da36b1d0ab8d5
-
C:\Users\Admin\AppData\Local\Temp\uoIk.exeFilesize
800KB
MD546dbe3e32914e2a93c6b7077c5a11780
SHA10215d30894ff980aeb20218c3a0aaff36e94daad
SHA256f66579b2e4489f1f4187d3ae95ef309e6ad5951c1bbe80e24cccf82a78bdd7ac
SHA5124ef4231fb8f2d43d3d6d1607e7485c202a5cd34be26878efd9c4cccae135a0f1b0af9f9cc184a6594be000a4464b77526f5d867bbe3b1632abf86ef896d1ece4
-
C:\Users\Admin\AppData\Local\Temp\uwMA.exeFilesize
206KB
MD5f2af333230d864fb888975df5589981a
SHA11129115d9e58af3a0c983403a8aab3be3552ce14
SHA2569cacd486714db752d868ac260715972af330628c82c949ce1cfb623c5f93b8dd
SHA5122cd5b57432054fe53dc59f7ef030fe06f1f0f62249909912f881095ab2e3433d6878558ab48c42a887849b2c302a7e6c5a105d9644171adc3ee9cef26921b760
-
C:\Users\Admin\AppData\Local\Temp\wAEE.exeFilesize
634KB
MD55e3e11f4f4e7592cbe982bc473622728
SHA10f805dd6b93b308b6ee9d4ce29ba8b2d0c089fe3
SHA256bb1446cb222dd73264c90580a4ee62ddf502072187661653b4302e30afcedcb3
SHA5127e8c9d3c8945e6e676648688db3ac24651a3cf5144f6d9d4472553065adc8d2150e33c25084849b5a8e1cd984eaf68b74c849a3608c76329dcd991be68e154b0
-
C:\Users\Admin\AppData\Local\Temp\wAYw.exeFilesize
186KB
MD54438410fdba4fe9fc1da16597a6be684
SHA11dcc5cb788a9009c2c263fdca935c399fff5f084
SHA256dccdd137fd08fc3149c5db3d3cbbcfa410ec5f418bc3793950047b278e49a58d
SHA512027133ab4f666d5f7a6a856ffda1fbde49078b829e3c4483cd78cca7d519f917d7056941ea2b0931f8bc2fc5930305fa01dde1e4393355365e6dcc3853736eaf
-
C:\Users\Admin\AppData\Local\Temp\wski.exeFilesize
208KB
MD565d16c62e2099c6423f13b9e64e9fbbc
SHA118f6efe1249d0a7a95e4e3ee15b5bb6a404b1055
SHA25698f2d6bb7781234cc04dd86e4352ad19b12fb208f67cf70c54b3596983782fd6
SHA512f8e89abd621d51f0986f668300f87dc97a2a68994878bd285e726cecae8a7288e088921c1690794641f541810428503055596870832bc7cb55265777274efb2c
-
C:\Users\Admin\AppData\Local\Temp\yAIS.exeFilesize
186KB
MD5424553f712bdc02d5c291edc64b045cc
SHA123cee5ba3c93498fbb1b385f4ec4d0c456ba2d79
SHA25656319c05e2a9b3c7b0785ac67a23b1db819438dcc4f7e4b7c477edcf79bba8ae
SHA512fe854dd453741784e916c9be1c610eea03e87d2960ea125d55c5b73dad46b97e6ba5f3800ed18ecef5871dbd7c17153f29610f50bc75104654a7cdfa5f5849d4
-
C:\Users\Admin\AppData\Local\Temp\yQIi.exeFilesize
940KB
MD57ec92317d12705c7abb49fa231da44fa
SHA1b639e8aff188121ac1d635282f95e7b6fb422fda
SHA25662b13b2681583d61207eb01f907eb1bd993d313a55c86d9f18e616fcf344c3e8
SHA51227d98081bf25c7ed9315a5dc621f695e03f8eb6497d059bba0b5eeb1acb2fc5a7b591f5cdb40d8deb2aca03e06090168a2e0806123398f82636d875602ff908a
-
C:\Users\Admin\AppData\Local\Temp\yUom.exeFilesize
200KB
MD5c62d52d26ef1535e2fafe680d8017f33
SHA188ce7daf945300898447c8e8a4bb7854357aea96
SHA256b44f1b52a4edbf005a75908eecef8a80067f5414ab125e7a4c2afe9f1de32fa9
SHA512b9f6f24895e70dbbc9288e88f80f26c05179e8cafb7cfec74b7c5afceb41001aac3d731bbbc89e672f5aa406ade0094e99c9be9c6d4339bd6e1ae16306766b42
-
C:\Users\Admin\Music\UnblockProtect.mpg.exeFilesize
485KB
MD5db5ea6b1118cf51f13b43635f51e0bd6
SHA112742d03debf33fa09b8b5edae8e0a8470b2135a
SHA256ff29f71701b5e299baec9f8d65b65ac9ba7acea9e561040191150658a01280a3
SHA5121847800113380e84486bfdd9072ddd35fd5c8c1180538a1b7a818c1a9589f6d0ce3d147011ec8f08d054889c153cc64f52031a23fc1ce61f3dffb524f3e2b995
-
C:\Users\Admin\Pictures\My Wallpaper.jpg.exeFilesize
208KB
MD51ae1cd9bb7f8c0814285b185422b414d
SHA15cc7e05ec9116784f3714ec950b68521c08b1657
SHA256ca515edbf60b82679f3951bbc881d70bda0107362dc62006fd60f6961c13ca7a
SHA5126a8f56becd27304341a76aa6c0edb7f6963583d5200a18fc0850db02e3eff0a8600012c531dacd528f84abced2e2ed9aca2d232ad27a699c80c2bfad93fc0331
-
C:\Users\Admin\Pictures\UnlockUnprotect.gif.exeFilesize
828KB
MD59983f7ddba3c3c5be94a6135e1aea656
SHA1a56483a37c855918676c4ec4dfd9213cae95e4b7
SHA2565a48a149999361fb9d97fde79c22ea4a7658b52eba98a25d72eb6b0651fe895f
SHA5120f85a5a844b51426d91f1fd7b355c265d9fac079ce23e1f247939b354b487f028eeeb8df303a0983542ed0238645932cf91c7667cf2dfaad4a63c87e5a4e8c9f
-
C:\Users\Admin\SQoIcAMo\JisAokUk.exeFilesize
185KB
MD5ef168db19360d2827684484fc0fab9f7
SHA1202628dd00bb0511dbdb6c4de140deb766721350
SHA256fe35856fe0497ba612c729aeb253d2c763332209b9c7091d055ac99d5c369696
SHA51278b09608d3afd2d7512647bae05cea679b25bc9c664da848a7c952c5474bce35e78040d246878dca228d00f204cbb0389a1836f8728921c565906219df6c0382
-
C:\Users\Admin\SQoIcAMo\JisAokUk.infFilesize
4B
MD58755d95e77f94f0ed40bbac5ac35eeb5
SHA18e973da76bafe7637940079ed2f6b6865e9e85e9
SHA256a8ce90229c0860fb31af14e7198fe6349139c09a7a6d1bc18aa48ad56101c77c
SHA512e388d874531c6b0e500185d1d7cc2b6381fda973ea67aa5cb7fbf82779be98897f61fb0451f69bc313a7228c1520988b8d280e452fbc851159492644571fbde3
-
memory/368-157-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/368-172-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/608-325-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/608-496-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/608-506-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/608-312-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/1084-344-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/1084-337-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/1244-168-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/1244-184-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/1284-183-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/1284-196-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/1472-455-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/1472-467-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/1488-391-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/1488-379-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/1640-244-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/1640-232-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/1672-287-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/1840-541-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/1852-416-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/1852-429-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/1860-92-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/1860-108-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/1896-523-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/1896-516-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2012-437-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2012-449-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2016-486-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2016-477-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2084-382-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2296-401-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2296-411-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2428-146-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2428-130-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2448-303-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2448-316-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2524-514-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2648-321-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2648-334-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3008-20-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3008-0-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3152-278-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3348-534-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3372-478-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3372-464-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3460-407-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3460-420-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3480-55-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3480-72-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3492-134-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3492-122-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3496-217-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3496-233-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3580-15-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/3584-257-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3584-270-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3672-142-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3672-158-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3904-345-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3904-354-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3916-7-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/4148-34-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/4148-19-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/4296-373-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/4296-359-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/4440-221-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/4824-488-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/4824-495-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/4832-458-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/4832-445-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/4844-48-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/4844-58-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/4972-121-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/4972-104-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/5080-440-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/5080-425-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/5140-30-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/5140-45-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/5232-294-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/5232-307-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/5404-207-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/5404-192-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/5464-298-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/5464-283-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/5616-350-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/5616-364-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/5848-390-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/5848-402-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/5852-533-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/5860-84-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/5860-68-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/5960-96-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/5960-80-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/6008-261-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/6008-245-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB