Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 15:24
Static task
static1
Behavioral task
behavioral1
Sample
766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe
-
Size
210KB
-
MD5
766249a530aa703b840fd933c8280be0
-
SHA1
d40e338e876575b05fff13d1df1fa8663a426204
-
SHA256
18c4bdd73b8b6fdf0c7af192a0eccbcc1cdd89a72d074b3930549c8fe4b3fb42
-
SHA512
99b64f8f466bb1e5dd07eceb3bade7d511d71a3c7a440bd2531a6dfc7eb882c5e47dde89dbc73da2aae2129ac127b43fd241c09762996bff13c103836d19f153
-
SSDEEP
6144:qsn8iXz5qkz0K6fnD04dMV5Qp+9144KvC+t:Jn8SH0K6e4o1QH
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" -
Renames multiple (82) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Blocklisted process makes network request 2 IoCs
Processes:
flow pid process 26 316 27 316 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
rOkUkskc.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation rOkUkskc.exe -
Executes dropped EXE 2 IoCs
Processes:
FeksMEkQ.exerOkUkskc.exepid process 912 FeksMEkQ.exe 2384 rOkUkskc.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
766249a530aa703b840fd933c8280be0_NeikiAnalytics.exerOkUkskc.exeFeksMEkQ.exe766249a530aa703b840fd933c8280be0_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FeksMEkQ.exe = "C:\\Users\\Admin\\jYkkUAoc\\FeksMEkQ.exe" 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\rOkUkskc.exe = "C:\\ProgramData\\byIkkcAw\\rOkUkskc.exe" 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\rOkUkskc.exe = "C:\\ProgramData\\byIkkcAw\\rOkUkskc.exe" rOkUkskc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FeksMEkQ.exe = "C:\\Users\\Admin\\jYkkUAoc\\FeksMEkQ.exe" FeksMEkQ.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IiEgkQIM.exe = "C:\\Users\\Admin\\JkAAAEwU\\IiEgkQIM.exe" 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SUEAAIsM.exe = "C:\\ProgramData\\lAoMQcsw\\SUEAAIsM.exe" 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe -
Drops file in System32 directory 2 IoCs
Processes:
rOkUkskc.exedescription ioc process File opened for modification C:\Windows\SysWOW64\shell32.dll.exe rOkUkskc.exe File created C:\Windows\SysWOW64\shell32.dll.exe rOkUkskc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2984 4308 WerFault.exe IiEgkQIM.exe 2552 1372 WerFault.exe SUEAAIsM.exe -
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 2576 reg.exe 1804 reg.exe 4928 reg.exe 3544 reg.exe 1708 reg.exe 1160 reg.exe 4648 reg.exe 3756 reg.exe 4936 1648 2912 reg.exe 2088 reg.exe 860 reg.exe 1716 4736 reg.exe 1232 reg.exe 4840 reg.exe 1244 reg.exe 4180 1632 reg.exe 3560 reg.exe 4400 3000 reg.exe 4008 reg.exe 3236 reg.exe 3524 reg.exe 4416 reg.exe 2028 reg.exe 3180 1180 4676 reg.exe 4380 reg.exe 216 reg.exe 1204 reg.exe 2056 reg.exe 5084 reg.exe 4180 reg.exe 324 reg.exe 4212 reg.exe 3860 reg.exe 5100 reg.exe 5064 reg.exe 864 4936 reg.exe 4500 reg.exe 1424 reg.exe 4164 reg.exe 3692 reg.exe 2884 reg.exe 376 reg.exe 2904 reg.exe 3568 reg.exe 4120 reg.exe 2188 reg.exe 552 reg.exe 5024 reg.exe 3236 reg.exe 1080 reg.exe 928 reg.exe 316 reg.exe 1804 reg.exe 1880 reg.exe 4896 reg.exe 4480 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe766249a530aa703b840fd933c8280be0_NeikiAnalytics.exepid process 3960 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 3960 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 3960 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 3960 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 4260 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 4260 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 4260 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 4260 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 2532 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 2532 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 2532 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 2532 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 4552 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 4552 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 4552 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 4552 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 4976 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 4976 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 4976 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 4976 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 1588 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 1588 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 1588 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 1588 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 3932 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 3932 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 3932 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 3932 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 3584 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 3584 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 3584 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 3584 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 1436 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 1436 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 1436 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 1436 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 3304 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 3304 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 3304 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 3304 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 4320 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 4320 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 4320 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 4320 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 1596 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 1596 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 1596 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 1596 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 512 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 512 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 512 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 512 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 3628 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 3628 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 3628 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 3628 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 3700 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 3700 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 3700 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 3700 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 3508 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 3508 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 3508 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe 3508 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
rOkUkskc.exepid process 2384 rOkUkskc.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
rOkUkskc.exepid process 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe 2384 rOkUkskc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
766249a530aa703b840fd933c8280be0_NeikiAnalytics.execmd.execmd.exe766249a530aa703b840fd933c8280be0_NeikiAnalytics.execmd.execmd.exe766249a530aa703b840fd933c8280be0_NeikiAnalytics.execmd.exedescription pid process target process PID 3960 wrote to memory of 912 3960 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe FeksMEkQ.exe PID 3960 wrote to memory of 912 3960 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe FeksMEkQ.exe PID 3960 wrote to memory of 912 3960 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe FeksMEkQ.exe PID 3960 wrote to memory of 2384 3960 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe rOkUkskc.exe PID 3960 wrote to memory of 2384 3960 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe rOkUkskc.exe PID 3960 wrote to memory of 2384 3960 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe rOkUkskc.exe PID 3960 wrote to memory of 2088 3960 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe cmd.exe PID 3960 wrote to memory of 2088 3960 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe cmd.exe PID 3960 wrote to memory of 2088 3960 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe cmd.exe PID 2088 wrote to memory of 4260 2088 cmd.exe 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe PID 2088 wrote to memory of 4260 2088 cmd.exe 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe PID 2088 wrote to memory of 4260 2088 cmd.exe 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe PID 3960 wrote to memory of 456 3960 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe reg.exe PID 3960 wrote to memory of 456 3960 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe reg.exe PID 3960 wrote to memory of 456 3960 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe reg.exe PID 3960 wrote to memory of 4612 3960 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe reg.exe PID 3960 wrote to memory of 4612 3960 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe reg.exe PID 3960 wrote to memory of 4612 3960 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe reg.exe PID 3960 wrote to memory of 1492 3960 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe reg.exe PID 3960 wrote to memory of 1492 3960 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe reg.exe PID 3960 wrote to memory of 1492 3960 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe reg.exe PID 3960 wrote to memory of 4840 3960 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe cmd.exe PID 3960 wrote to memory of 4840 3960 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe cmd.exe PID 3960 wrote to memory of 4840 3960 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe cmd.exe PID 4840 wrote to memory of 2804 4840 cmd.exe cscript.exe PID 4840 wrote to memory of 2804 4840 cmd.exe cscript.exe PID 4840 wrote to memory of 2804 4840 cmd.exe cscript.exe PID 4260 wrote to memory of 2536 4260 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe cmd.exe PID 4260 wrote to memory of 2536 4260 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe cmd.exe PID 4260 wrote to memory of 2536 4260 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe cmd.exe PID 2536 wrote to memory of 2532 2536 cmd.exe 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe PID 2536 wrote to memory of 2532 2536 cmd.exe 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe PID 2536 wrote to memory of 2532 2536 cmd.exe 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe PID 4260 wrote to memory of 1632 4260 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe reg.exe PID 4260 wrote to memory of 1632 4260 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe reg.exe PID 4260 wrote to memory of 1632 4260 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe reg.exe PID 4260 wrote to memory of 1804 4260 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe reg.exe PID 4260 wrote to memory of 1804 4260 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe reg.exe PID 4260 wrote to memory of 1804 4260 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe reg.exe PID 4260 wrote to memory of 5100 4260 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe reg.exe PID 4260 wrote to memory of 5100 4260 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe reg.exe PID 4260 wrote to memory of 5100 4260 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe reg.exe PID 4260 wrote to memory of 4444 4260 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe cmd.exe PID 4260 wrote to memory of 4444 4260 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe cmd.exe PID 4260 wrote to memory of 4444 4260 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe cmd.exe PID 4444 wrote to memory of 5048 4444 cmd.exe cscript.exe PID 4444 wrote to memory of 5048 4444 cmd.exe cscript.exe PID 4444 wrote to memory of 5048 4444 cmd.exe cscript.exe PID 2532 wrote to memory of 2432 2532 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe cmd.exe PID 2532 wrote to memory of 2432 2532 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe cmd.exe PID 2532 wrote to memory of 2432 2532 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe cmd.exe PID 2432 wrote to memory of 4552 2432 cmd.exe 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe PID 2432 wrote to memory of 4552 2432 cmd.exe 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe PID 2432 wrote to memory of 4552 2432 cmd.exe 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe PID 2532 wrote to memory of 3168 2532 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe reg.exe PID 2532 wrote to memory of 3168 2532 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe reg.exe PID 2532 wrote to memory of 3168 2532 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe reg.exe PID 2532 wrote to memory of 4688 2532 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe reg.exe PID 2532 wrote to memory of 4688 2532 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe reg.exe PID 2532 wrote to memory of 4688 2532 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe reg.exe PID 2532 wrote to memory of 3000 2532 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe reg.exe PID 2532 wrote to memory of 3000 2532 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe reg.exe PID 2532 wrote to memory of 3000 2532 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe reg.exe PID 2532 wrote to memory of 1084 2532 766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\jYkkUAoc\FeksMEkQ.exe"C:\Users\Admin\jYkkUAoc\FeksMEkQ.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:912 -
C:\ProgramData\byIkkcAw\rOkUkskc.exe"C:\ProgramData\byIkkcAw\rOkUkskc.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:2384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"2⤵
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"4⤵
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"6⤵
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics7⤵
- Suspicious behavior: EnumeratesProcesses
PID:4552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"8⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics9⤵
- Suspicious behavior: EnumeratesProcesses
PID:4976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"10⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics11⤵
- Suspicious behavior: EnumeratesProcesses
PID:1588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"12⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics13⤵
- Suspicious behavior: EnumeratesProcesses
PID:3932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"14⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics15⤵
- Suspicious behavior: EnumeratesProcesses
PID:3584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"16⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics17⤵
- Suspicious behavior: EnumeratesProcesses
PID:1436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"18⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics19⤵
- Suspicious behavior: EnumeratesProcesses
PID:3304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"20⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics21⤵
- Suspicious behavior: EnumeratesProcesses
PID:4320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"22⤵PID:3832
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV123⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics23⤵
- Suspicious behavior: EnumeratesProcesses
PID:1596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"24⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics25⤵
- Suspicious behavior: EnumeratesProcesses
PID:512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"26⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics27⤵
- Suspicious behavior: EnumeratesProcesses
PID:3628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"28⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics29⤵
- Suspicious behavior: EnumeratesProcesses
PID:3700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"30⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics31⤵
- Suspicious behavior: EnumeratesProcesses
PID:3508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"32⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics33⤵PID:4716
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"34⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics35⤵PID:2224
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"36⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics37⤵PID:436
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"38⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics39⤵PID:3292
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"40⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics41⤵PID:3236
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"42⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics43⤵PID:1260
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"44⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics45⤵PID:4572
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"46⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics47⤵PID:4968
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"48⤵PID:3932
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV149⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics49⤵PID:4264
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"50⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics51⤵PID:1524
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"52⤵PID:4164
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV153⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics53⤵PID:1512
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"54⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics55⤵PID:1076
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"56⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics57⤵PID:916
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"58⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics59⤵PID:3524
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"60⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics61⤵PID:3628
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"62⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics63⤵PID:2432
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"64⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics65⤵PID:1180
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"66⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics67⤵PID:4868
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"68⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics69⤵PID:3168
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"70⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics71⤵PID:2244
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"72⤵PID:100
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV173⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics73⤵PID:3528
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"74⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics75⤵PID:1212
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"76⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics77⤵PID:4004
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"78⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics79⤵PID:3332
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"80⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics81⤵PID:4788
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"82⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics83⤵PID:4444
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"84⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics85⤵PID:2436
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"86⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics87⤵PID:3736
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"88⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics89⤵PID:4644
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"90⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics91⤵PID:4436
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"92⤵PID:4268
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV193⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics93⤵PID:2580
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"94⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics95⤵PID:3964
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"96⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics97⤵PID:2224
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"98⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics99⤵PID:324
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"100⤵PID:2884
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1101⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics101⤵PID:2896
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"102⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics103⤵PID:3012
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"104⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics105⤵PID:4108
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"106⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics107⤵PID:3528
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"108⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics109⤵PID:1708
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"110⤵PID:4176
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1111⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics111⤵PID:2104
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"112⤵PID:3492
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1113⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics113⤵PID:3660
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"114⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics115⤵PID:2580
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"116⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics117⤵PID:4164
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"118⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics119⤵PID:3172
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"120⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics121⤵PID:2856
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"122⤵PID:3628
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1123⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics123⤵PID:4396
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"124⤵PID:4260
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1125⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics125⤵PID:2884
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"126⤵PID:4108
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1127⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics127⤵PID:432
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"128⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics129⤵PID:3492
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"130⤵PID:264
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1131⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics131⤵PID:4576
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"132⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics133⤵PID:3376
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"134⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics135⤵PID:400
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"136⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics137⤵PID:4008
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"138⤵PID:4688
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1139⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics139⤵PID:748
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"140⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics141⤵PID:376
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"142⤵PID:4216
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1143⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics143⤵PID:3336
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"144⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics145⤵PID:1776
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"146⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics147⤵PID:2528
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"148⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics149⤵PID:4740
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"150⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics151⤵PID:3320
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"152⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics153⤵PID:3348
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"154⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics155⤵PID:5052
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"156⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics157⤵PID:4356
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"158⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics159⤵PID:1184
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"160⤵PID:2576
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1161⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics161⤵PID:4840
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"162⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics163⤵PID:4600
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"164⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics165⤵PID:4264
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"166⤵PID:1612
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1167⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics167⤵PID:4168
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"168⤵PID:4164
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1169⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics169⤵PID:400
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"170⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics171⤵PID:3736
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"172⤵PID:4536
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1173⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics173⤵PID:1588
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"174⤵PID:2556
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1175⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics175⤵PID:4604
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"176⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics177⤵PID:2576
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"178⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics179⤵PID:216
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"180⤵PID:2260
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1181⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics181⤵PID:1588
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"182⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics183⤵PID:452
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"184⤵PID:2884
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1185⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics185⤵PID:2492
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"186⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics187⤵PID:2104
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"188⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics189⤵PID:4260
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"190⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics191⤵PID:100
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"192⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics193⤵PID:1616
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"194⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics195⤵PID:2544
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"196⤵PID:3968
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1197⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics197⤵
- Adds Run key to start application
PID:2312 -
C:\Users\Admin\JkAAAEwU\IiEgkQIM.exe"C:\Users\Admin\JkAAAEwU\IiEgkQIM.exe"198⤵PID:4308
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 224199⤵
- Program crash
PID:2984 -
C:\ProgramData\lAoMQcsw\SUEAAIsM.exe"C:\ProgramData\lAoMQcsw\SUEAAIsM.exe"198⤵PID:1372
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 220199⤵
- Program crash
PID:2552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"198⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics199⤵PID:3464
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"200⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics201⤵PID:2652
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"202⤵PID:264
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1203⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics203⤵PID:3180
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"204⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics205⤵PID:4584
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"206⤵PID:2912
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1207⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics207⤵PID:2492
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"208⤵PID:1472
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1209⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics209⤵PID:5000
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"210⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics211⤵PID:2576
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"212⤵PID:3336
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1213⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics213⤵PID:4004
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"214⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics215⤵PID:4268
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"216⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics217⤵PID:3012
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"218⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics219⤵PID:4928
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"220⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics221⤵PID:2244
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"222⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics223⤵PID:3236
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"224⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics225⤵PID:1348
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"226⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics227⤵PID:5052
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"228⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics229⤵PID:4888
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"230⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics231⤵PID:2244
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"232⤵PID:1648
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1233⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics233⤵PID:1064
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"234⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics235⤵PID:2912
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"236⤵PID:2624
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1237⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics237⤵PID:664
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"238⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics239⤵PID:376
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics"240⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\766249a530aa703b840fd933c8280be0_NeikiAnalytics241⤵PID:1704
-