Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 16:55
Static task
static1
Behavioral task
behavioral1
Sample
7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe
-
Size
203KB
-
MD5
7c371d13aefb5594f50c8d7a8bb03410
-
SHA1
b4e3647a35a520198a0c3c6594f9adfdb1339a9e
-
SHA256
30264b5993122c541fd30703046019ab0a050923b1d112dbe3adaa7486b1ba89
-
SHA512
f9e65ce5027840daa668336f2c8685fa7958cf09925d95c8354a90a20ba92d667a3226b810a40179c373ab71fc77d3b1f8eefd160864eb8fbe50d506d4b72694
-
SSDEEP
6144:u0waM/BuBVBFjBhjJ+jyZGjwHRwTvPjsD5dJjHZmN8je/eOLjpdjBIjBgBQ8ISAy:lzTWTSNlGx
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (59) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
jsIUQsUQ.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\International\Geo\Nation jsIUQsUQ.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2888 cmd.exe -
Executes dropped EXE 2 IoCs
Processes:
jsIUQsUQ.exefQowYQIw.exepid process 1672 jsIUQsUQ.exe 2612 fQowYQIw.exe -
Loads dropped DLL 20 IoCs
Processes:
7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exejsIUQsUQ.exepid process 1932 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 1932 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 1932 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 1932 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
jsIUQsUQ.exefQowYQIw.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\jsIUQsUQ.exe = "C:\\Users\\Admin\\TywAMcUA\\jsIUQsUQ.exe" jsIUQsUQ.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\fQowYQIw.exe = "C:\\ProgramData\\KicAcMcQ\\fQowYQIw.exe" fQowYQIw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\jsIUQsUQ.exe = "C:\\Users\\Admin\\TywAMcUA\\jsIUQsUQ.exe" 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\fQowYQIw.exe = "C:\\ProgramData\\KicAcMcQ\\fQowYQIw.exe" 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe -
Drops file in Windows directory 1 IoCs
Processes:
jsIUQsUQ.exedescription ioc process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico jsIUQsUQ.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 1552 reg.exe 940 reg.exe 2672 reg.exe 1936 reg.exe 2564 reg.exe 2804 reg.exe 2332 reg.exe 592 reg.exe 1264 reg.exe 1596 reg.exe 2288 reg.exe 2348 reg.exe 2824 reg.exe 2412 reg.exe 2544 reg.exe 1320 reg.exe 824 reg.exe 2456 reg.exe 2428 reg.exe 1064 reg.exe 112 reg.exe 2912 reg.exe 280 reg.exe 2488 reg.exe 2204 reg.exe 1960 reg.exe 2708 reg.exe 2796 reg.exe 2092 reg.exe 1240 reg.exe 2832 reg.exe 2436 reg.exe 960 reg.exe 1080 reg.exe 2504 reg.exe 2604 reg.exe 2212 reg.exe 2832 reg.exe 2696 reg.exe 2516 reg.exe 2728 reg.exe 2244 reg.exe 824 reg.exe 2760 reg.exe 1096 reg.exe 1964 reg.exe 2620 reg.exe 1308 reg.exe 2676 reg.exe 1336 reg.exe 2660 reg.exe 2004 reg.exe 2040 reg.exe 1416 reg.exe 1072 reg.exe 2420 reg.exe 2968 reg.exe 1156 reg.exe 876 reg.exe 2472 reg.exe 2748 reg.exe 480 reg.exe 2656 reg.exe 2044 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exepid process 1932 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 1932 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 2756 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 2756 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 2808 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 2808 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 576 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 576 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 2928 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 2928 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 2000 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 2000 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 1464 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 1464 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 2504 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 2504 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 2804 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 2804 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 2608 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 2608 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 532 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 532 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 2592 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 2592 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 2656 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 2656 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 1628 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 1628 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 1616 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 1616 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 2804 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 2804 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 1816 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 1816 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 1308 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 1308 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 2660 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 2660 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 2024 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 2024 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 1064 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 1064 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 1228 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 1228 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 892 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 892 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 864 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 864 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 2732 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 2732 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 2188 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 2188 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 2756 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 2756 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 2876 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 2876 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 1768 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 1768 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 900 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 900 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 1592 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 1592 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 2704 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 2704 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
jsIUQsUQ.exepid process 1672 jsIUQsUQ.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
jsIUQsUQ.exepid process 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe 1672 jsIUQsUQ.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.execmd.execmd.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.execmd.execmd.exedescription pid process target process PID 1932 wrote to memory of 1672 1932 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe jsIUQsUQ.exe PID 1932 wrote to memory of 1672 1932 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe jsIUQsUQ.exe PID 1932 wrote to memory of 1672 1932 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe jsIUQsUQ.exe PID 1932 wrote to memory of 1672 1932 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe jsIUQsUQ.exe PID 1932 wrote to memory of 2612 1932 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe fQowYQIw.exe PID 1932 wrote to memory of 2612 1932 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe fQowYQIw.exe PID 1932 wrote to memory of 2612 1932 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe fQowYQIw.exe PID 1932 wrote to memory of 2612 1932 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe fQowYQIw.exe PID 1932 wrote to memory of 2648 1932 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe cmd.exe PID 1932 wrote to memory of 2648 1932 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe cmd.exe PID 1932 wrote to memory of 2648 1932 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe cmd.exe PID 1932 wrote to memory of 2648 1932 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe cmd.exe PID 2648 wrote to memory of 2756 2648 cmd.exe 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe PID 2648 wrote to memory of 2756 2648 cmd.exe 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe PID 2648 wrote to memory of 2756 2648 cmd.exe 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe PID 2648 wrote to memory of 2756 2648 cmd.exe 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe PID 1932 wrote to memory of 1620 1932 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 1932 wrote to memory of 1620 1932 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 1932 wrote to memory of 1620 1932 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 1932 wrote to memory of 1620 1932 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 1932 wrote to memory of 2796 1932 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 1932 wrote to memory of 2796 1932 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 1932 wrote to memory of 2796 1932 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 1932 wrote to memory of 2796 1932 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 1932 wrote to memory of 1156 1932 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 1932 wrote to memory of 1156 1932 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 1932 wrote to memory of 1156 1932 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 1932 wrote to memory of 1156 1932 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 1932 wrote to memory of 2532 1932 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe cmd.exe PID 1932 wrote to memory of 2532 1932 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe cmd.exe PID 1932 wrote to memory of 2532 1932 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe cmd.exe PID 1932 wrote to memory of 2532 1932 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe cmd.exe PID 2532 wrote to memory of 2472 2532 cmd.exe cscript.exe PID 2532 wrote to memory of 2472 2532 cmd.exe cscript.exe PID 2532 wrote to memory of 2472 2532 cmd.exe cscript.exe PID 2532 wrote to memory of 2472 2532 cmd.exe cscript.exe PID 2756 wrote to memory of 2736 2756 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe cmd.exe PID 2756 wrote to memory of 2736 2756 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe cmd.exe PID 2756 wrote to memory of 2736 2756 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe cmd.exe PID 2756 wrote to memory of 2736 2756 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe cmd.exe PID 2736 wrote to memory of 2808 2736 cmd.exe 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe PID 2736 wrote to memory of 2808 2736 cmd.exe 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe PID 2736 wrote to memory of 2808 2736 cmd.exe 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe PID 2736 wrote to memory of 2808 2736 cmd.exe 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe PID 2756 wrote to memory of 2836 2756 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 2756 wrote to memory of 2836 2756 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 2756 wrote to memory of 2836 2756 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 2756 wrote to memory of 2836 2756 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 2756 wrote to memory of 2824 2756 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 2756 wrote to memory of 2824 2756 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 2756 wrote to memory of 2824 2756 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 2756 wrote to memory of 2824 2756 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 2756 wrote to memory of 2848 2756 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 2756 wrote to memory of 2848 2756 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 2756 wrote to memory of 2848 2756 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 2756 wrote to memory of 2848 2756 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 2756 wrote to memory of 2868 2756 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe cmd.exe PID 2756 wrote to memory of 2868 2756 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe cmd.exe PID 2756 wrote to memory of 2868 2756 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe cmd.exe PID 2756 wrote to memory of 2868 2756 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe cmd.exe PID 2868 wrote to memory of 1236 2868 cmd.exe cscript.exe PID 2868 wrote to memory of 1236 2868 cmd.exe cscript.exe PID 2868 wrote to memory of 1236 2868 cmd.exe cscript.exe PID 2868 wrote to memory of 1236 2868 cmd.exe cscript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\TywAMcUA\jsIUQsUQ.exe"C:\Users\Admin\TywAMcUA\jsIUQsUQ.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\KicAcMcQ\fQowYQIw.exe"C:\ProgramData\KicAcMcQ\fQowYQIw.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"6⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"8⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"10⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"12⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"14⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"16⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"18⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"20⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"22⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"24⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"26⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"28⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"30⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"32⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"34⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics35⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"36⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics37⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"38⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics39⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"40⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics41⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"42⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics43⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"44⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics45⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"46⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics47⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"48⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics49⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"50⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics51⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"52⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics53⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"54⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics55⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"56⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics57⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"58⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics59⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"60⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics61⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"62⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics63⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"64⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics65⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"66⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics67⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"68⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics69⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"70⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics71⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"72⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics73⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"74⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics75⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"76⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics77⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"78⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics79⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"80⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics81⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"82⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics83⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"84⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics85⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"86⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics87⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"88⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics89⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"90⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics91⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"92⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics93⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"94⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics95⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"96⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics97⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"98⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics99⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"100⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics101⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"102⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics103⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"104⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics105⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"106⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics107⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"108⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics109⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"110⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics111⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"112⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics113⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"114⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics115⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"116⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics117⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"118⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics119⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"120⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics121⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"122⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics123⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"124⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics125⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"126⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics127⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"128⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics129⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"130⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics131⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"132⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics133⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"134⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics135⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"136⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics137⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"138⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics139⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"140⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics141⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"142⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics143⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"144⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics145⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"146⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics147⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"148⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics149⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"150⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics151⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"152⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics153⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"154⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics155⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"156⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics157⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"158⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics159⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"160⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics161⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"162⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics163⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"164⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics165⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"166⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics167⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"168⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics169⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"170⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics171⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"172⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics173⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"174⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics175⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"176⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics177⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"178⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics179⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"180⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics181⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"182⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics183⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"184⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics185⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"186⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics187⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"188⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics189⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"190⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics191⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"192⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics193⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"194⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics195⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"196⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics197⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"198⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics199⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"200⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics201⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"202⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics203⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"204⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics205⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"206⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics207⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"208⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics209⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"210⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics211⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"212⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics213⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"214⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics215⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"216⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics217⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"218⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics219⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"220⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics221⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"222⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics223⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"224⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics225⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"226⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics227⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"228⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics229⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"230⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics231⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"232⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics233⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"234⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics235⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"236⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics237⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"238⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics239⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"240⤵
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics241⤵