Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23/05/2024, 08:29
Static task
static1
Behavioral task
behavioral1
Sample
c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe
-
Size
194KB
-
MD5
c8d136dedf82a0d5a1457276390f2fd0
-
SHA1
18fde16cafcde2ad9c94077b1b96b84444f9347a
-
SHA256
27b5f2426d36bd9ea8954db23d3252d84262d7fc383daf2ca166a25fea290da9
-
SHA512
5f6be37d84441424a8ff800b6c4250f5583d45b95387f1ab274c55c3869ecebcb5683304cfa6eb657b0be23a96bdddcba88451d13ecc4b4f5a5f15c4876502e2
-
SSDEEP
6144:gGatRGlokdIH982PoucNI1LtdKFJCnPXFVR0QrGC9hH8X4XXXG9D4D9SDHpbqHin:IROS98b1uw
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (79) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation yyUEYUIM.exe -
Executes dropped EXE 2 IoCs
pid Process 1548 zSQEUwwI.exe 1076 yyUEYUIM.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zSQEUwwI.exe = "C:\\Users\\Admin\\zyIcEkYI\\zSQEUwwI.exe" c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\yyUEYUIM.exe = "C:\\ProgramData\\VQIIcgkw\\yyUEYUIM.exe" c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\yyUEYUIM.exe = "C:\\ProgramData\\VQIIcgkw\\yyUEYUIM.exe" yyUEYUIM.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zSQEUwwI.exe = "C:\\Users\\Admin\\zyIcEkYI\\zSQEUwwI.exe" zSQEUwwI.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
pid Process 520 reg.exe 4572 reg.exe 776 reg.exe 4376 reg.exe 652 reg.exe 3148 Process not Found 4488 reg.exe 3076 reg.exe 1400 Process not Found 2860 Process not Found 4744 reg.exe 3632 reg.exe 2340 reg.exe 1624 reg.exe 4968 Process not Found 552 Process not Found 2744 Process not Found 4388 reg.exe 4416 reg.exe 1784 reg.exe 1404 Process not Found 4580 Process not Found 4192 Process not Found 3912 reg.exe 3784 reg.exe 3676 reg.exe 2324 reg.exe 900 reg.exe 468 reg.exe 2124 reg.exe 428 reg.exe 1436 reg.exe 2864 reg.exe 2712 Process not Found 368 Process not Found 1052 reg.exe 2384 reg.exe 2952 reg.exe 1312 reg.exe 604 reg.exe 3776 reg.exe 3344 reg.exe 4924 reg.exe 2368 Process not Found 1612 reg.exe 428 reg.exe 5096 reg.exe 4372 reg.exe 2820 reg.exe 4964 reg.exe 1280 reg.exe 2656 reg.exe 1440 reg.exe 1680 reg.exe 2384 reg.exe 1508 reg.exe 4012 reg.exe 1856 reg.exe 4500 reg.exe 3128 reg.exe 4384 reg.exe 2956 reg.exe 3796 reg.exe 2476 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4196 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 4196 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 4196 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 4196 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 4380 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 4380 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 4380 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 4380 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 3472 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 3472 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 3472 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 3472 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 2344 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 2344 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 2344 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 2344 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 3356 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 3356 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 3356 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 3356 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 4940 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 4940 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 4940 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 4940 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 4740 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 4740 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 4740 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 4740 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 4372 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 4372 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 4372 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 4372 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 1164 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 1164 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 1164 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 1164 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 1460 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 1460 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 1460 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 1460 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 4676 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 4676 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 4676 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 4676 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 384 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 384 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 384 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 384 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 4272 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 4272 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 4272 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 4272 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 2744 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 2744 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 2744 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 2744 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 4720 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 4720 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 4720 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 4720 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 448 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 448 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 448 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 448 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1076 yyUEYUIM.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe 1076 yyUEYUIM.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4196 wrote to memory of 1548 4196 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 83 PID 4196 wrote to memory of 1548 4196 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 83 PID 4196 wrote to memory of 1548 4196 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 83 PID 4196 wrote to memory of 1076 4196 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 84 PID 4196 wrote to memory of 1076 4196 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 84 PID 4196 wrote to memory of 1076 4196 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 84 PID 4196 wrote to memory of 1932 4196 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 85 PID 4196 wrote to memory of 1932 4196 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 85 PID 4196 wrote to memory of 1932 4196 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 85 PID 1932 wrote to memory of 4380 1932 cmd.exe 87 PID 1932 wrote to memory of 4380 1932 cmd.exe 87 PID 1932 wrote to memory of 4380 1932 cmd.exe 87 PID 4196 wrote to memory of 4388 4196 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 88 PID 4196 wrote to memory of 4388 4196 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 88 PID 4196 wrote to memory of 4388 4196 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 88 PID 4196 wrote to memory of 2284 4196 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 89 PID 4196 wrote to memory of 2284 4196 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 89 PID 4196 wrote to memory of 2284 4196 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 89 PID 4196 wrote to memory of 2252 4196 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 90 PID 4196 wrote to memory of 2252 4196 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 90 PID 4196 wrote to memory of 2252 4196 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 90 PID 4196 wrote to memory of 3064 4196 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 92 PID 4196 wrote to memory of 3064 4196 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 92 PID 4196 wrote to memory of 3064 4196 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 92 PID 3064 wrote to memory of 5008 3064 cmd.exe 96 PID 3064 wrote to memory of 5008 3064 cmd.exe 96 PID 3064 wrote to memory of 5008 3064 cmd.exe 96 PID 4380 wrote to memory of 3680 4380 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 97 PID 4380 wrote to memory of 3680 4380 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 97 PID 4380 wrote to memory of 3680 4380 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 97 PID 3680 wrote to memory of 3472 3680 cmd.exe 99 PID 3680 wrote to memory of 3472 3680 cmd.exe 99 PID 3680 wrote to memory of 3472 3680 cmd.exe 99 PID 4380 wrote to memory of 3440 4380 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 100 PID 4380 wrote to memory of 3440 4380 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 100 PID 4380 wrote to memory of 3440 4380 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 100 PID 4380 wrote to memory of 2724 4380 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 101 PID 4380 wrote to memory of 2724 4380 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 101 PID 4380 wrote to memory of 2724 4380 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 101 PID 4380 wrote to memory of 2532 4380 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 102 PID 4380 wrote to memory of 2532 4380 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 102 PID 4380 wrote to memory of 2532 4380 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 102 PID 4380 wrote to memory of 1432 4380 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 103 PID 4380 wrote to memory of 1432 4380 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 103 PID 4380 wrote to memory of 1432 4380 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 103 PID 1432 wrote to memory of 1440 1432 cmd.exe 108 PID 1432 wrote to memory of 1440 1432 cmd.exe 108 PID 1432 wrote to memory of 1440 1432 cmd.exe 108 PID 3472 wrote to memory of 3400 3472 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 109 PID 3472 wrote to memory of 3400 3472 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 109 PID 3472 wrote to memory of 3400 3472 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 109 PID 3400 wrote to memory of 2344 3400 cmd.exe 111 PID 3400 wrote to memory of 2344 3400 cmd.exe 111 PID 3400 wrote to memory of 2344 3400 cmd.exe 111 PID 3472 wrote to memory of 4028 3472 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 112 PID 3472 wrote to memory of 4028 3472 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 112 PID 3472 wrote to memory of 4028 3472 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 112 PID 3472 wrote to memory of 3988 3472 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 113 PID 3472 wrote to memory of 3988 3472 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 113 PID 3472 wrote to memory of 3988 3472 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 113 PID 3472 wrote to memory of 4552 3472 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 114 PID 3472 wrote to memory of 4552 3472 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 114 PID 3472 wrote to memory of 4552 3472 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 114 PID 3472 wrote to memory of 1232 3472 c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\zyIcEkYI\zSQEUwwI.exe"C:\Users\Admin\zyIcEkYI\zSQEUwwI.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1548
-
-
C:\ProgramData\VQIIcgkw\yyUEYUIM.exe"C:\ProgramData\VQIIcgkw\yyUEYUIM.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:1076
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"2⤵
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"4⤵
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"6⤵
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics7⤵
- Suspicious behavior: EnumeratesProcesses
PID:2344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"8⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics9⤵
- Suspicious behavior: EnumeratesProcesses
PID:3356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"10⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics11⤵
- Suspicious behavior: EnumeratesProcesses
PID:4940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"12⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics13⤵
- Suspicious behavior: EnumeratesProcesses
PID:4740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"14⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics15⤵
- Suspicious behavior: EnumeratesProcesses
PID:4372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"16⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics17⤵
- Suspicious behavior: EnumeratesProcesses
PID:1164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"18⤵PID:912
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV119⤵PID:4564
-
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics19⤵
- Suspicious behavior: EnumeratesProcesses
PID:1460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"20⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics21⤵
- Suspicious behavior: EnumeratesProcesses
PID:4676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"22⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics23⤵
- Suspicious behavior: EnumeratesProcesses
PID:384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"24⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics25⤵
- Suspicious behavior: EnumeratesProcesses
PID:4272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"26⤵PID:4708
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV127⤵PID:1164
-
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics27⤵
- Suspicious behavior: EnumeratesProcesses
PID:2744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"28⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics29⤵
- Suspicious behavior: EnumeratesProcesses
PID:4720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"30⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics31⤵
- Suspicious behavior: EnumeratesProcesses
PID:448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"32⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics33⤵PID:1148
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"34⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics35⤵PID:2364
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"36⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics37⤵PID:216
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"38⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics39⤵PID:896
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"40⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics41⤵PID:3436
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"42⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics43⤵PID:3688
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"44⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics45⤵PID:1248
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"46⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics47⤵PID:2732
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"48⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics49⤵PID:4192
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"50⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics51⤵PID:2744
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"52⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics53⤵PID:988
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"54⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics55⤵PID:2864
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"56⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics57⤵PID:4260
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"58⤵PID:4716
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV159⤵PID:2196
-
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics59⤵PID:1404
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"60⤵PID:1628
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV161⤵PID:896
-
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics61⤵PID:1280
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"62⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics63⤵PID:1052
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"64⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics65⤵PID:4484
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"66⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics67⤵PID:3504
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"68⤵PID:4056
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV169⤵PID:1400
-
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics69⤵PID:708
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"70⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics71⤵PID:4432
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"72⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics73⤵PID:4708
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"74⤵PID:3736
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV175⤵PID:4388
-
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics75⤵PID:3504
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"76⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics77⤵PID:3172
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"78⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics79⤵PID:1220
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"80⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics81⤵PID:4736
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"82⤵PID:1644
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV183⤵PID:428
-
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics83⤵PID:2268
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"84⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics85⤵PID:4192
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"86⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics87⤵PID:4512
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"88⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics89⤵PID:1288
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"90⤵PID:2960
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV191⤵PID:3620
-
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics91⤵PID:3988
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"92⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics93⤵PID:4484
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"94⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics95⤵PID:4376
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"96⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics97⤵PID:2884
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"98⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics99⤵PID:1440
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"100⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics101⤵PID:4484
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"102⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics103⤵PID:3776
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"104⤵PID:2748
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1105⤵PID:4708
-
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics105⤵PID:1504
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"106⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics107⤵PID:4368
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"108⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics109⤵PID:3148
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"110⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics111⤵PID:3432
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"112⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics113⤵PID:2096
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"114⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics115⤵PID:3260
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"116⤵PID:4892
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1117⤵PID:4500
-
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics117⤵PID:2100
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"118⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics119⤵PID:1624
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"120⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics121⤵PID:4200
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c8d136dedf82a0d5a1457276390f2fd0_NeikiAnalytics"122⤵PID:3184
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-