Analysis
-
max time kernel
150s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 10:13
Static task
static1
Behavioral task
behavioral1
Sample
72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe
-
Size
197KB
-
MD5
72509d49f3851562fb5975d8f794c1c0
-
SHA1
e8e9a0dbad2e4ae2f0f456d0a61f2f9113a8eba5
-
SHA256
50d1e3a96be1b89d75bf0e6ef2d3682613eb56f9c640eb82d7f964939be7b132
-
SHA512
472d57ad5ac31573d6688279d003b78bf1c4da3d73be7f73ed92bd73c82c7899e02345a97a50fff7d5ff4e6f2603e16828bbf42c9a7daf7b9d2860a2707e6451
-
SSDEEP
6144:ue3wXWDldPYqh5vkmVxXRSkwWu1/wPI0UtY:RwXQllh5vk4xXRuWKt
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (73) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
BsMwsMcM.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation BsMwsMcM.exe -
Executes dropped EXE 2 IoCs
Processes:
BsMwsMcM.exezKEMckcI.exepid process 4792 BsMwsMcM.exe 4056 zKEMckcI.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeBsMwsMcM.exezKEMckcI.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BsMwsMcM.exe = "C:\\Users\\Admin\\DwEMgwYU\\BsMwsMcM.exe" 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\zKEMckcI.exe = "C:\\ProgramData\\XoUQkMkk\\zKEMckcI.exe" 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BsMwsMcM.exe = "C:\\Users\\Admin\\DwEMgwYU\\BsMwsMcM.exe" BsMwsMcM.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\zKEMckcI.exe = "C:\\ProgramData\\XoUQkMkk\\zKEMckcI.exe" zKEMckcI.exe -
Drops file in System32 directory 2 IoCs
Processes:
BsMwsMcM.exedescription ioc process File created C:\Windows\SysWOW64\shell32.dll.exe BsMwsMcM.exe File opened for modification C:\Windows\SysWOW64\shell32.dll.exe BsMwsMcM.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 2696 reg.exe 4016 reg.exe 4444 reg.exe 1172 reg.exe 3216 reg.exe 2004 reg.exe 2620 reg.exe 4132 reg.exe 2336 reg.exe 3068 reg.exe 2428 reg.exe 428 reg.exe 2864 2296 reg.exe 4080 reg.exe 508 4728 1200 reg.exe 3316 reg.exe 2840 reg.exe 1216 4912 4404 2376 reg.exe 4876 reg.exe 3316 reg.exe 4852 reg.exe 4768 reg.exe 2552 reg.exe 1804 4452 reg.exe 1060 4912 804 3692 reg.exe 4940 reg.exe 440 5064 reg.exe 4444 reg.exe 4132 reg.exe 2780 reg.exe 4868 reg.exe 2620 1072 reg.exe 1376 reg.exe 1224 reg.exe 3104 reg.exe 4396 reg.exe 4784 reg.exe 3340 reg.exe 2444 reg.exe 4628 reg.exe 464 reg.exe 2444 1444 reg.exe 1072 reg.exe 1328 reg.exe 4724 reg.exe 1924 4452 reg.exe 3212 reg.exe 2560 reg.exe 4332 reg.exe 996 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exepid process 2296 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 2296 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 2296 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 2296 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 1784 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 1784 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 1784 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 1784 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 4748 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 4748 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 4748 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 4748 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 2864 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 2864 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 2864 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 2864 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 4288 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 4288 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 4288 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 4288 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 1832 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 1832 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 1832 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 1832 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 2936 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 2936 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 2936 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 2936 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 3752 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 3752 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 3752 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 3752 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 4600 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 4600 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 4600 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 4600 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 2484 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 2484 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 2484 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 2484 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 3324 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 3324 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 3324 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 3324 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 1948 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 1948 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 1948 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 1948 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 4468 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 4468 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 4468 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 4468 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 3748 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 3748 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 3748 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 3748 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 2376 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 2376 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 2376 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 2376 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 1700 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 1700 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 1700 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe 1700 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
BsMwsMcM.exepid process 4792 BsMwsMcM.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
BsMwsMcM.exepid process 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe 4792 BsMwsMcM.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.execmd.execmd.exe72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.execmd.execmd.exe72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.execmd.exedescription pid process target process PID 2296 wrote to memory of 4792 2296 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe BsMwsMcM.exe PID 2296 wrote to memory of 4792 2296 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe BsMwsMcM.exe PID 2296 wrote to memory of 4792 2296 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe BsMwsMcM.exe PID 2296 wrote to memory of 4056 2296 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe zKEMckcI.exe PID 2296 wrote to memory of 4056 2296 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe zKEMckcI.exe PID 2296 wrote to memory of 4056 2296 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe zKEMckcI.exe PID 2296 wrote to memory of 3316 2296 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe cmd.exe PID 2296 wrote to memory of 3316 2296 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe cmd.exe PID 2296 wrote to memory of 3316 2296 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe cmd.exe PID 2296 wrote to memory of 60 2296 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe reg.exe PID 2296 wrote to memory of 60 2296 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe reg.exe PID 2296 wrote to memory of 60 2296 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe reg.exe PID 2296 wrote to memory of 3216 2296 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe reg.exe PID 2296 wrote to memory of 3216 2296 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe reg.exe PID 2296 wrote to memory of 3216 2296 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe reg.exe PID 2296 wrote to memory of 1200 2296 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe reg.exe PID 2296 wrote to memory of 1200 2296 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe reg.exe PID 2296 wrote to memory of 1200 2296 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe reg.exe PID 2296 wrote to memory of 1760 2296 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe cmd.exe PID 2296 wrote to memory of 1760 2296 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe cmd.exe PID 2296 wrote to memory of 1760 2296 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe cmd.exe PID 3316 wrote to memory of 1784 3316 cmd.exe 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe PID 3316 wrote to memory of 1784 3316 cmd.exe 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe PID 3316 wrote to memory of 1784 3316 cmd.exe 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe PID 1760 wrote to memory of 520 1760 cmd.exe cscript.exe PID 1760 wrote to memory of 520 1760 cmd.exe cscript.exe PID 1760 wrote to memory of 520 1760 cmd.exe cscript.exe PID 1784 wrote to memory of 1556 1784 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe cmd.exe PID 1784 wrote to memory of 1556 1784 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe cmd.exe PID 1784 wrote to memory of 1556 1784 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe cmd.exe PID 1556 wrote to memory of 4748 1556 cmd.exe 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe PID 1556 wrote to memory of 4748 1556 cmd.exe 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe PID 1556 wrote to memory of 4748 1556 cmd.exe 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe PID 1784 wrote to memory of 4984 1784 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe reg.exe PID 1784 wrote to memory of 4984 1784 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe reg.exe PID 1784 wrote to memory of 4984 1784 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe reg.exe PID 1784 wrote to memory of 4796 1784 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe reg.exe PID 1784 wrote to memory of 4796 1784 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe reg.exe PID 1784 wrote to memory of 4796 1784 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe reg.exe PID 1784 wrote to memory of 760 1784 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe reg.exe PID 1784 wrote to memory of 760 1784 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe reg.exe PID 1784 wrote to memory of 760 1784 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe reg.exe PID 1784 wrote to memory of 4332 1784 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe cmd.exe PID 1784 wrote to memory of 4332 1784 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe cmd.exe PID 1784 wrote to memory of 4332 1784 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe cmd.exe PID 4332 wrote to memory of 4876 4332 cmd.exe cscript.exe PID 4332 wrote to memory of 4876 4332 cmd.exe cscript.exe PID 4332 wrote to memory of 4876 4332 cmd.exe cscript.exe PID 4748 wrote to memory of 2684 4748 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe cmd.exe PID 4748 wrote to memory of 2684 4748 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe cmd.exe PID 4748 wrote to memory of 2684 4748 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe cmd.exe PID 2684 wrote to memory of 2864 2684 cmd.exe 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe PID 2684 wrote to memory of 2864 2684 cmd.exe 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe PID 2684 wrote to memory of 2864 2684 cmd.exe 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe PID 4748 wrote to memory of 884 4748 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe reg.exe PID 4748 wrote to memory of 884 4748 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe reg.exe PID 4748 wrote to memory of 884 4748 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe reg.exe PID 4748 wrote to memory of 1300 4748 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe reg.exe PID 4748 wrote to memory of 1300 4748 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe reg.exe PID 4748 wrote to memory of 1300 4748 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe reg.exe PID 4748 wrote to memory of 1800 4748 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe reg.exe PID 4748 wrote to memory of 1800 4748 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe reg.exe PID 4748 wrote to memory of 1800 4748 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe reg.exe PID 4748 wrote to memory of 3104 4748 72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\DwEMgwYU\BsMwsMcM.exe"C:\Users\Admin\DwEMgwYU\BsMwsMcM.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\XoUQkMkk\zKEMckcI.exe"C:\ProgramData\XoUQkMkk\zKEMckcI.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"8⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"10⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"12⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"14⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"16⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"18⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"20⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"22⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"24⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"26⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"28⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"30⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"32⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"34⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV135⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"36⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV137⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"38⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"40⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"42⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV143⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"44⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"46⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"48⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"50⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"52⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"54⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"56⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV157⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"58⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"60⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"62⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"64⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"66⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"68⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"70⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics71⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"72⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV173⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics73⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"74⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"76⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics77⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"78⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics79⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"80⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics81⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"82⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics83⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"84⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics85⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"86⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics87⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"88⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics89⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"90⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"92⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV193⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics93⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"94⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics95⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"96⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics97⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"98⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV199⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics99⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"100⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics101⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"102⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics103⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"104⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics105⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"106⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1107⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics107⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"108⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics109⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"110⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics111⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"112⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics113⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"114⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics115⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"116⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics117⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"118⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1119⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics119⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"120⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics121⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"122⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics123⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"124⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics125⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"126⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics127⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"128⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics129⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"130⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics131⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"132⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics133⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"134⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1135⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics135⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"136⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1137⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics137⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"138⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1139⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics139⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"140⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics141⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"142⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1143⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics143⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"144⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics145⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"146⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1147⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics147⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"148⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics149⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"150⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics151⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"152⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics153⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"154⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics155⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"156⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics157⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"158⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1159⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics159⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"160⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics161⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"162⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics163⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"164⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1165⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics165⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"166⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1167⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics167⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"168⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1169⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics169⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"170⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics171⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"172⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics173⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"174⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics175⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"176⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics177⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"178⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics179⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"180⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics181⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"182⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics183⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"184⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1185⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics185⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"186⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1187⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics187⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"188⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics189⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"190⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1191⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics191⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"192⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1193⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics193⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"194⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1195⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics195⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"196⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics197⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"198⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics199⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"200⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics201⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"202⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics203⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"204⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1205⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics205⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"206⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1207⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics207⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"208⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics209⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"210⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics211⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"212⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics213⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"214⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics215⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"216⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics217⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"218⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics219⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"220⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics221⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"222⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics223⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"224⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1225⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics225⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"226⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics227⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"228⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics229⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"230⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics231⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"232⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics233⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"234⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1235⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics235⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"236⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics237⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"238⤵
-
C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics239⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72509d49f3851562fb5975d8f794c1c0_NeikiAnalytics"240⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1241⤵