Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 06:28
Static task
static1
Behavioral task
behavioral1
Sample
19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe
-
Size
196KB
-
MD5
19eaa32a799fa546a8d7c965635f0f20
-
SHA1
fe03b7024762a411ca4ad58646dcc2d9ec529d88
-
SHA256
0d363d8455514c13834e4a7e97f457930cbdfc009106239d75cbbec130985fac
-
SHA512
57e3738ab88bf12546d872d383e33a5af5e98eb46b0af31e21380b7dfa99003da58683b2fb2b430bb97457b6c5e43c52bb930304d3eb08f8181cc7cff3aba4cd
-
SSDEEP
3072:Q3OHRcho84LJYsDcXvm191q0rbFlvWlodPaBoMbM:Q3Oxz84LmsIg11rbzuvBoMbM
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (80) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
TaUIUMEQ.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation TaUIUMEQ.exe -
Executes dropped EXE 2 IoCs
Processes:
fUQMUwQc.exeTaUIUMEQ.exepid process 4836 fUQMUwQc.exe 3920 TaUIUMEQ.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeTaUIUMEQ.exefUQMUwQc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fUQMUwQc.exe = "C:\\Users\\Admin\\jGwQUkMY\\fUQMUwQc.exe" 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TaUIUMEQ.exe = "C:\\ProgramData\\mAsQoYIg\\TaUIUMEQ.exe" 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TaUIUMEQ.exe = "C:\\ProgramData\\mAsQoYIg\\TaUIUMEQ.exe" TaUIUMEQ.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fUQMUwQc.exe = "C:\\Users\\Admin\\jGwQUkMY\\fUQMUwQc.exe" fUQMUwQc.exe -
Drops file in System32 directory 2 IoCs
Processes:
TaUIUMEQ.exedescription ioc process File created C:\Windows\SysWOW64\shell32.dll.exe TaUIUMEQ.exe File opened for modification C:\Windows\SysWOW64\shell32.dll.exe TaUIUMEQ.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 1196 reg.exe 4828 reg.exe 2540 reg.exe 2536 reg.exe 3092 712 reg.exe 3028 reg.exe 2304 1992 reg.exe 1120 reg.exe 2540 reg.exe 1080 1260 reg.exe 624 reg.exe 5040 5048 reg.exe 2040 reg.exe 2460 872 reg.exe 2960 reg.exe 1260 reg.exe 2328 reg.exe 5016 reg.exe 2032 reg.exe 2816 reg.exe 3840 reg.exe 3840 reg.exe 444 reg.exe 60 reg.exe 1168 reg.exe 4864 3856 reg.exe 3316 reg.exe 3932 reg.exe 4824 reg.exe 212 reg.exe 3252 5100 reg.exe 1004 reg.exe 3568 reg.exe 3776 reg.exe 3156 reg.exe 4396 reg.exe 3616 reg.exe 3864 reg.exe 4804 reg.exe 1260 reg.exe 4440 reg.exe 2068 reg.exe 3440 reg.exe 1496 reg.exe 2460 1152 reg.exe 4336 reg.exe 3624 reg.exe 1652 reg.exe 4484 reg.exe 2380 reg.exe 5040 reg.exe 2380 reg.exe 4408 4348 reg.exe 2436 reg.exe 620 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exepid process 2168 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 2168 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 2168 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 2168 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 3772 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 3772 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 3772 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 3772 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 4228 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 4228 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 4228 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 4228 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 3948 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 3948 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 3948 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 3948 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 3444 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 3444 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 3444 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 3444 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 1460 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 1460 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 1460 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 1460 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 4196 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 4196 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 4196 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 4196 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 1068 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 1068 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 1068 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 1068 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 4548 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 4548 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 4548 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 4548 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 4456 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 4456 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 4456 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 4456 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 4392 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 4392 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 4392 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 4392 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 1388 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 1388 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 1388 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 1388 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 3984 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 3984 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 3984 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 3984 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 3680 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 3680 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 3680 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 3680 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 4328 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 4328 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 4328 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 4328 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 3528 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 3528 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 3528 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe 3528 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
TaUIUMEQ.exepid process 3920 TaUIUMEQ.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
TaUIUMEQ.exepid process 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe 3920 TaUIUMEQ.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.execmd.execmd.exe19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.execmd.execmd.exe19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.execmd.exedescription pid process target process PID 2168 wrote to memory of 4836 2168 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe fUQMUwQc.exe PID 2168 wrote to memory of 4836 2168 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe fUQMUwQc.exe PID 2168 wrote to memory of 4836 2168 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe fUQMUwQc.exe PID 2168 wrote to memory of 3920 2168 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe TaUIUMEQ.exe PID 2168 wrote to memory of 3920 2168 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe TaUIUMEQ.exe PID 2168 wrote to memory of 3920 2168 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe TaUIUMEQ.exe PID 2168 wrote to memory of 3904 2168 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe cmd.exe PID 2168 wrote to memory of 3904 2168 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe cmd.exe PID 2168 wrote to memory of 3904 2168 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe cmd.exe PID 3904 wrote to memory of 3772 3904 cmd.exe 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe PID 3904 wrote to memory of 3772 3904 cmd.exe 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe PID 3904 wrote to memory of 3772 3904 cmd.exe 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe PID 2168 wrote to memory of 2924 2168 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe reg.exe PID 2168 wrote to memory of 2924 2168 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe reg.exe PID 2168 wrote to memory of 2924 2168 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe reg.exe PID 2168 wrote to memory of 3436 2168 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe reg.exe PID 2168 wrote to memory of 3436 2168 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe reg.exe PID 2168 wrote to memory of 3436 2168 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe reg.exe PID 2168 wrote to memory of 3776 2168 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe reg.exe PID 2168 wrote to memory of 3776 2168 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe reg.exe PID 2168 wrote to memory of 3776 2168 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe reg.exe PID 2168 wrote to memory of 2912 2168 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe cmd.exe PID 2168 wrote to memory of 2912 2168 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe cmd.exe PID 2168 wrote to memory of 2912 2168 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe cmd.exe PID 2912 wrote to memory of 1896 2912 cmd.exe cscript.exe PID 2912 wrote to memory of 1896 2912 cmd.exe cscript.exe PID 2912 wrote to memory of 1896 2912 cmd.exe cscript.exe PID 3772 wrote to memory of 3152 3772 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe cmd.exe PID 3772 wrote to memory of 3152 3772 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe cmd.exe PID 3772 wrote to memory of 3152 3772 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe cmd.exe PID 3152 wrote to memory of 4228 3152 cmd.exe 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe PID 3152 wrote to memory of 4228 3152 cmd.exe 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe PID 3152 wrote to memory of 4228 3152 cmd.exe 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe PID 3772 wrote to memory of 3856 3772 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe reg.exe PID 3772 wrote to memory of 3856 3772 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe reg.exe PID 3772 wrote to memory of 3856 3772 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe reg.exe PID 3772 wrote to memory of 2256 3772 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe reg.exe PID 3772 wrote to memory of 2256 3772 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe reg.exe PID 3772 wrote to memory of 2256 3772 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe reg.exe PID 3772 wrote to memory of 3632 3772 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe reg.exe PID 3772 wrote to memory of 3632 3772 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe reg.exe PID 3772 wrote to memory of 3632 3772 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe reg.exe PID 3772 wrote to memory of 2960 3772 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe cmd.exe PID 3772 wrote to memory of 2960 3772 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe cmd.exe PID 3772 wrote to memory of 2960 3772 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe cmd.exe PID 2960 wrote to memory of 4752 2960 cmd.exe cscript.exe PID 2960 wrote to memory of 4752 2960 cmd.exe cscript.exe PID 2960 wrote to memory of 4752 2960 cmd.exe cscript.exe PID 4228 wrote to memory of 5112 4228 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe cmd.exe PID 4228 wrote to memory of 5112 4228 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe cmd.exe PID 4228 wrote to memory of 5112 4228 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe cmd.exe PID 5112 wrote to memory of 3948 5112 cmd.exe 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe PID 5112 wrote to memory of 3948 5112 cmd.exe 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe PID 5112 wrote to memory of 3948 5112 cmd.exe 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe PID 4228 wrote to memory of 1312 4228 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe reg.exe PID 4228 wrote to memory of 1312 4228 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe reg.exe PID 4228 wrote to memory of 1312 4228 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe reg.exe PID 4228 wrote to memory of 2032 4228 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe reg.exe PID 4228 wrote to memory of 2032 4228 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe reg.exe PID 4228 wrote to memory of 2032 4228 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe reg.exe PID 4228 wrote to memory of 1132 4228 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe reg.exe PID 4228 wrote to memory of 1132 4228 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe reg.exe PID 4228 wrote to memory of 1132 4228 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe reg.exe PID 4228 wrote to memory of 4224 4228 19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\jGwQUkMY\fUQMUwQc.exe"C:\Users\Admin\jGwQUkMY\fUQMUwQc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4836 -
C:\ProgramData\mAsQoYIg\TaUIUMEQ.exe"C:\ProgramData\mAsQoYIg\TaUIUMEQ.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:3920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"2⤵
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"4⤵
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"6⤵
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics7⤵
- Suspicious behavior: EnumeratesProcesses
PID:3948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"8⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics9⤵
- Suspicious behavior: EnumeratesProcesses
PID:3444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"10⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics11⤵
- Suspicious behavior: EnumeratesProcesses
PID:1460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"12⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics13⤵
- Suspicious behavior: EnumeratesProcesses
PID:4196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"14⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics15⤵
- Suspicious behavior: EnumeratesProcesses
PID:1068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"16⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics17⤵
- Suspicious behavior: EnumeratesProcesses
PID:4548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"18⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics19⤵
- Suspicious behavior: EnumeratesProcesses
PID:4456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"20⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics21⤵
- Suspicious behavior: EnumeratesProcesses
PID:4392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"22⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics23⤵
- Suspicious behavior: EnumeratesProcesses
PID:1388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"24⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics25⤵
- Suspicious behavior: EnumeratesProcesses
PID:3984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"26⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics27⤵
- Suspicious behavior: EnumeratesProcesses
PID:3680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"28⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics29⤵
- Suspicious behavior: EnumeratesProcesses
PID:4328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"30⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics31⤵
- Suspicious behavior: EnumeratesProcesses
PID:3528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"32⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics33⤵PID:2004
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"34⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics35⤵PID:2536
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"36⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics37⤵PID:2652
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"38⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics39⤵PID:1692
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"40⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics41⤵PID:4296
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"42⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics43⤵PID:4260
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"44⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics45⤵PID:4708
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"46⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics47⤵PID:3628
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"48⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics49⤵PID:3064
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"50⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics51⤵PID:2524
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"52⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics53⤵PID:4828
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"54⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics55⤵PID:2376
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"56⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics57⤵PID:3564
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"58⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics59⤵PID:372
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"60⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics61⤵PID:4828
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"62⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics63⤵PID:2804
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"64⤵PID:2356
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV165⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics65⤵PID:2524
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"66⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics67⤵PID:1984
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"68⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics69⤵PID:1076
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"70⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics71⤵PID:4436
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"72⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics73⤵PID:1784
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"74⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics75⤵PID:3668
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"76⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics77⤵PID:2360
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"78⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics79⤵PID:4920
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"80⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics81⤵PID:4052
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"82⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics83⤵PID:3668
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"84⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics85⤵PID:3092
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"86⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics87⤵PID:2248
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"88⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics89⤵PID:3748
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"90⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics91⤵PID:5088
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"92⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics93⤵PID:928
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"94⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics95⤵PID:5024
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"96⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics97⤵PID:3748
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"98⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics99⤵PID:2040
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"100⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics101⤵PID:4172
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"102⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics103⤵PID:4452
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"104⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics105⤵PID:3040
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"106⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics107⤵PID:4716
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"108⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics109⤵PID:4072
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"110⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics111⤵PID:3892
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"112⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics113⤵PID:532
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"114⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics115⤵PID:4432
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"116⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics117⤵PID:3932
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"118⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics119⤵PID:4020
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"120⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics121⤵PID:4804
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"122⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics123⤵PID:4232
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"124⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics125⤵PID:4000
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"126⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics127⤵PID:1004
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"128⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics129⤵PID:2472
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"130⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics131⤵PID:4492
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"132⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics133⤵PID:3436
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"134⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics135⤵PID:4852
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"136⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics137⤵PID:4840
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"138⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics139⤵PID:1784
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"140⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics141⤵PID:2188
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"142⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics143⤵PID:1100
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"144⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics145⤵PID:1840
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"146⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics147⤵PID:4660
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"148⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics149⤵PID:5056
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"150⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics151⤵PID:2232
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"152⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics153⤵PID:4348
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"154⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics155⤵PID:3744
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"156⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics157⤵PID:1484
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"158⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics159⤵PID:1260
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"160⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics161⤵PID:5060
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"162⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics163⤵PID:1792
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"164⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics165⤵PID:2432
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"166⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics167⤵PID:5116
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"168⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics169⤵PID:5044
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"170⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics171⤵PID:2096
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"172⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics173⤵PID:2640
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"174⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics175⤵PID:2700
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"176⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics177⤵PID:4336
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"178⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics179⤵PID:5000
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"180⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics181⤵PID:3572
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"182⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics183⤵PID:2664
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"184⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics185⤵PID:4548
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"186⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics187⤵PID:4328
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"188⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics189⤵PID:5048
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"190⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics191⤵PID:4852
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"192⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics193⤵PID:3856
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"194⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics195⤵PID:1488
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"196⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics197⤵PID:940
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"198⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics199⤵PID:4232
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"200⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics201⤵PID:2464
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"202⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics203⤵PID:1264
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"204⤵PID:2372
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1205⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics205⤵PID:2844
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"206⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics207⤵PID:3160
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"208⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics209⤵PID:4484
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"210⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics211⤵PID:4304
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"212⤵PID:4852
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1213⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics213⤵PID:5088
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"214⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics215⤵PID:3680
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"216⤵PID:940
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1217⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics217⤵PID:3048
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"218⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics219⤵PID:2692
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"220⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics221⤵PID:4612
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"222⤵PID:3568
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1223⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics223⤵PID:2132
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"224⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics225⤵PID:4856
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"226⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics227⤵PID:1472
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"228⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics229⤵PID:4124
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"230⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics231⤵PID:712
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"232⤵PID:4396
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1233⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics233⤵PID:4840
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"234⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics235⤵PID:3744
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"236⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics237⤵PID:3504
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"238⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics239⤵PID:1196
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics"240⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\19eaa32a799fa546a8d7c965635f0f20_NeikiAnalytics241⤵PID:4948
-