Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 16:55
Static task
static1
Behavioral task
behavioral1
Sample
7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe
-
Size
203KB
-
MD5
7c371d13aefb5594f50c8d7a8bb03410
-
SHA1
b4e3647a35a520198a0c3c6594f9adfdb1339a9e
-
SHA256
30264b5993122c541fd30703046019ab0a050923b1d112dbe3adaa7486b1ba89
-
SHA512
f9e65ce5027840daa668336f2c8685fa7958cf09925d95c8354a90a20ba92d667a3226b810a40179c373ab71fc77d3b1f8eefd160864eb8fbe50d506d4b72694
-
SSDEEP
6144:u0waM/BuBVBFjBhjJ+jyZGjwHRwTvPjsD5dJjHZmN8je/eOLjpdjBIjBgBQ8ISAy:lzTWTSNlGx
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (83) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Blocklisted process makes network request 4 IoCs
Processes:
flow pid process 36 2500 39 2500 42 2500 43 2500 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
KyMcUIwg.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation KyMcUIwg.exe -
Executes dropped EXE 2 IoCs
Processes:
tyIsYYwM.exeKyMcUIwg.exepid process 3560 tyIsYYwM.exe 2848 KyMcUIwg.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeKyMcUIwg.exetyIsYYwM.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tyIsYYwM.exe = "C:\\Users\\Admin\\nKAEsoMs\\tyIsYYwM.exe" 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\KyMcUIwg.exe = "C:\\ProgramData\\UwcEEwsk\\KyMcUIwg.exe" 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\KyMcUIwg.exe = "C:\\ProgramData\\UwcEEwsk\\KyMcUIwg.exe" KyMcUIwg.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tyIsYYwM.exe = "C:\\Users\\Admin\\nKAEsoMs\\tyIsYYwM.exe" tyIsYYwM.exe -
Drops file in System32 directory 2 IoCs
Processes:
KyMcUIwg.exedescription ioc process File opened for modification C:\Windows\SysWOW64\shell32.dll.exe KyMcUIwg.exe File created C:\Windows\SysWOW64\shell32.dll.exe KyMcUIwg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 744 reg.exe 4952 reg.exe 3360 reg.exe 2688 reg.exe 5068 reg.exe 2488 reg.exe 5044 reg.exe 1828 reg.exe 4784 reg.exe 4704 reg.exe 4656 reg.exe 4332 reg.exe 1192 reg.exe 1416 reg.exe 1700 reg.exe 4348 reg.exe 3532 reg.exe 4496 reg.exe 4844 2760 reg.exe 688 reg.exe 1196 reg.exe 2252 reg.exe 1828 reg.exe 4928 3096 reg.exe 2460 reg.exe 2252 reg.exe 3652 reg.exe 1204 4668 reg.exe 1272 reg.exe 1328 2324 reg.exe 5044 reg.exe 1512 reg.exe 3864 548 reg.exe 4648 reg.exe 1440 reg.exe 3780 3780 reg.exe 1536 reg.exe 3908 reg.exe 1032 reg.exe 1412 reg.exe 3408 reg.exe 1536 reg.exe 3652 1832 2344 reg.exe 3048 reg.exe 2460 reg.exe 1872 reg.exe 3652 reg.exe 1296 reg.exe 4768 reg.exe 4548 reg.exe 2224 reg.exe 4452 reg.exe 1512 reg.exe 3192 reg.exe 4856 reg.exe 2724 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exepid process 4868 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 4868 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 4868 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 4868 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 3404 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 3404 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 3404 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 3404 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 3684 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 3684 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 3684 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 3684 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 736 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 736 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 736 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 736 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 3048 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 3048 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 3048 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 3048 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 4312 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 4312 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 4312 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 4312 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 1920 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 1920 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 1920 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 1920 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 1060 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 1060 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 1060 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 1060 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 3096 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 3096 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 3096 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 3096 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 1200 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 1200 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 1200 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 1200 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 5004 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 5004 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 5004 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 5004 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 4992 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 4992 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 4992 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 4992 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 2712 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 2712 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 2712 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 2712 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 3424 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 3424 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 3424 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 3424 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 3756 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 3756 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 3756 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 3756 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 2136 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 2136 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 2136 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe 2136 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
KyMcUIwg.exepid process 2848 KyMcUIwg.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
KyMcUIwg.exepid process 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe 2848 KyMcUIwg.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.execmd.execmd.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.execmd.execmd.exe7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.execmd.exedescription pid process target process PID 4868 wrote to memory of 3560 4868 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe tyIsYYwM.exe PID 4868 wrote to memory of 3560 4868 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe tyIsYYwM.exe PID 4868 wrote to memory of 3560 4868 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe tyIsYYwM.exe PID 4868 wrote to memory of 2848 4868 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe KyMcUIwg.exe PID 4868 wrote to memory of 2848 4868 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe KyMcUIwg.exe PID 4868 wrote to memory of 2848 4868 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe KyMcUIwg.exe PID 4868 wrote to memory of 4268 4868 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe cmd.exe PID 4868 wrote to memory of 4268 4868 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe cmd.exe PID 4868 wrote to memory of 4268 4868 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe cmd.exe PID 4868 wrote to memory of 3044 4868 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 4868 wrote to memory of 3044 4868 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 4868 wrote to memory of 3044 4868 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 4868 wrote to memory of 4144 4868 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 4868 wrote to memory of 4144 4868 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 4868 wrote to memory of 4144 4868 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 4868 wrote to memory of 3192 4868 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 4868 wrote to memory of 3192 4868 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 4868 wrote to memory of 3192 4868 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 4868 wrote to memory of 3492 4868 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe cmd.exe PID 4868 wrote to memory of 3492 4868 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe cmd.exe PID 4868 wrote to memory of 3492 4868 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe cmd.exe PID 4268 wrote to memory of 3404 4268 cmd.exe 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe PID 4268 wrote to memory of 3404 4268 cmd.exe 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe PID 4268 wrote to memory of 3404 4268 cmd.exe 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe PID 3492 wrote to memory of 4072 3492 cmd.exe cscript.exe PID 3492 wrote to memory of 4072 3492 cmd.exe cscript.exe PID 3492 wrote to memory of 4072 3492 cmd.exe cscript.exe PID 3404 wrote to memory of 3980 3404 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe cmd.exe PID 3404 wrote to memory of 3980 3404 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe cmd.exe PID 3404 wrote to memory of 3980 3404 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe cmd.exe PID 3980 wrote to memory of 3684 3980 cmd.exe 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe PID 3980 wrote to memory of 3684 3980 cmd.exe 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe PID 3980 wrote to memory of 3684 3980 cmd.exe 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe PID 3404 wrote to memory of 548 3404 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 3404 wrote to memory of 548 3404 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 3404 wrote to memory of 548 3404 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 3404 wrote to memory of 2688 3404 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 3404 wrote to memory of 2688 3404 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 3404 wrote to memory of 2688 3404 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 3404 wrote to memory of 4924 3404 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 3404 wrote to memory of 4924 3404 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 3404 wrote to memory of 4924 3404 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 3404 wrote to memory of 1996 3404 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe cmd.exe PID 3404 wrote to memory of 1996 3404 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe cmd.exe PID 3404 wrote to memory of 1996 3404 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe cmd.exe PID 1996 wrote to memory of 3012 1996 cmd.exe cscript.exe PID 1996 wrote to memory of 3012 1996 cmd.exe cscript.exe PID 1996 wrote to memory of 3012 1996 cmd.exe cscript.exe PID 3684 wrote to memory of 5104 3684 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe cmd.exe PID 3684 wrote to memory of 5104 3684 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe cmd.exe PID 3684 wrote to memory of 5104 3684 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe cmd.exe PID 5104 wrote to memory of 736 5104 cmd.exe 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe PID 5104 wrote to memory of 736 5104 cmd.exe 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe PID 5104 wrote to memory of 736 5104 cmd.exe 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe PID 3684 wrote to memory of 1256 3684 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 3684 wrote to memory of 1256 3684 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 3684 wrote to memory of 1256 3684 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 3684 wrote to memory of 2296 3684 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 3684 wrote to memory of 2296 3684 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 3684 wrote to memory of 2296 3684 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 3684 wrote to memory of 1156 3684 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 3684 wrote to memory of 1156 3684 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 3684 wrote to memory of 1156 3684 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe reg.exe PID 3684 wrote to memory of 4848 3684 7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\nKAEsoMs\tyIsYYwM.exe"C:\Users\Admin\nKAEsoMs\tyIsYYwM.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3560 -
C:\ProgramData\UwcEEwsk\KyMcUIwg.exe"C:\ProgramData\UwcEEwsk\KyMcUIwg.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:2848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"2⤵
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"4⤵
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"6⤵
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics7⤵
- Suspicious behavior: EnumeratesProcesses
PID:736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"8⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics9⤵
- Suspicious behavior: EnumeratesProcesses
PID:3048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"10⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics11⤵
- Suspicious behavior: EnumeratesProcesses
PID:4312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"12⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics13⤵
- Suspicious behavior: EnumeratesProcesses
PID:1920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"14⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics15⤵
- Suspicious behavior: EnumeratesProcesses
PID:1060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"16⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics17⤵
- Suspicious behavior: EnumeratesProcesses
PID:3096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"18⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics19⤵
- Suspicious behavior: EnumeratesProcesses
PID:1200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"20⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics21⤵
- Suspicious behavior: EnumeratesProcesses
PID:5004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"22⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics23⤵
- Suspicious behavior: EnumeratesProcesses
PID:4992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"24⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics25⤵
- Suspicious behavior: EnumeratesProcesses
PID:2712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"26⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics27⤵
- Suspicious behavior: EnumeratesProcesses
PID:3424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"28⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics29⤵
- Suspicious behavior: EnumeratesProcesses
PID:3756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"30⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics31⤵
- Suspicious behavior: EnumeratesProcesses
PID:2136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"32⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics33⤵PID:4056
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"34⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics35⤵PID:3172
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"36⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics37⤵PID:4132
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"38⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics39⤵PID:736
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"40⤵PID:4064
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV141⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics41⤵PID:3264
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"42⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics43⤵PID:3048
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"44⤵PID:1440
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV145⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics45⤵PID:2200
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"46⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics47⤵PID:4700
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"48⤵PID:1928
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV149⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics49⤵PID:3212
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"50⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics51⤵PID:3540
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"52⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics53⤵PID:2712
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"54⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics55⤵PID:4424
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"56⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics57⤵PID:1196
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"58⤵PID:924
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV159⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics59⤵PID:3488
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"60⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics61⤵PID:1516
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"62⤵PID:4580
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV163⤵PID:492
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics63⤵PID:4952
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"64⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics65⤵PID:916
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"66⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics67⤵PID:4044
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"68⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics69⤵PID:2428
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"70⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics71⤵PID:2108
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"72⤵PID:3064
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV173⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics73⤵PID:3372
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"74⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics75⤵PID:1268
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"76⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics77⤵PID:2724
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"78⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics79⤵PID:1060
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"80⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics81⤵PID:1412
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"82⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics83⤵PID:4644
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"84⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics85⤵PID:4432
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"86⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics87⤵PID:3928
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"88⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics89⤵PID:3424
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"90⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics91⤵PID:4536
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"92⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics93⤵PID:4512
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"94⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics95⤵PID:3780
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"96⤵PID:4060
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV197⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics97⤵PID:4972
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"98⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics99⤵PID:3696
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"100⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics101⤵PID:5044
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"102⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics103⤵PID:4840
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"104⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics105⤵PID:5056
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"106⤵PID:3048
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1107⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics107⤵PID:688
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"108⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics109⤵PID:768
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"110⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics111⤵PID:3700
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"112⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics113⤵PID:2472
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"114⤵PID:876
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1115⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics115⤵PID:1544
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"116⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics117⤵PID:5032
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"118⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics119⤵PID:3700
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"120⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics121⤵PID:4536
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"122⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics123⤵PID:3240
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"124⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics125⤵PID:1208
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"126⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics127⤵PID:1272
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"128⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics129⤵PID:3856
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"130⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics131⤵PID:4312
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"132⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics133⤵PID:4516
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"134⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics135⤵PID:4320
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"136⤵PID:3064
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1137⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics137⤵PID:2344
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"138⤵PID:1560
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1139⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics139⤵PID:1576
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"140⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics141⤵PID:4132
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"142⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics143⤵PID:3020
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"144⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics145⤵PID:660
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"146⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics147⤵PID:3012
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"148⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics149⤵PID:2544
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"150⤵PID:3524
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1151⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics151⤵PID:3912
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"152⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics153⤵PID:660
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"154⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics155⤵PID:3752
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"156⤵PID:552
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1157⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics157⤵PID:2488
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"158⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics159⤵PID:1560
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"160⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics161⤵PID:4552
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"162⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics163⤵PID:4508
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"164⤵PID:944
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1165⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics165⤵PID:1832
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"166⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics167⤵PID:4496
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"168⤵PID:4448
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1169⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics169⤵PID:812
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"170⤵PID:4288
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1171⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics171⤵PID:3828
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"172⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics173⤵PID:3212
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"174⤵PID:452
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1175⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics175⤵PID:4844
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"176⤵PID:3416
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1177⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics177⤵PID:4508
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"178⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics179⤵PID:4608
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"180⤵PID:2072
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1181⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics181⤵PID:3196
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"182⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics183⤵PID:3652
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"184⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics185⤵PID:4900
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"186⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics187⤵PID:1032
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"188⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics189⤵PID:1644
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"190⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics191⤵PID:2340
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"192⤵PID:5096
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1193⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics193⤵PID:4528
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"194⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics195⤵PID:1272
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"196⤵PID:2712
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1197⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics197⤵PID:3716
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"198⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics199⤵PID:3752
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"200⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics201⤵PID:3592
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"202⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics203⤵PID:4940
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"204⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics205⤵PID:4280
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"206⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics207⤵PID:4952
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"208⤵PID:3664
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1209⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics209⤵PID:2796
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"210⤵PID:2580
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1211⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics211⤵PID:2592
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"212⤵PID:3604
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1213⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics213⤵PID:4952
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"214⤵PID:1208
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1215⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics215⤵PID:4292
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"216⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics217⤵PID:4900
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"218⤵PID:1648
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1219⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics219⤵PID:3232
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"220⤵PID:1368
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1221⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics221⤵PID:1756
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"222⤵PID:1284
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1223⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics223⤵PID:4644
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"224⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics225⤵PID:3652
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"226⤵PID:736
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1227⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics227⤵PID:4928
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"228⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics229⤵PID:5052
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"230⤵PID:4916
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1231⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics231⤵PID:616
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"232⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics233⤵PID:4952
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"234⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics235⤵PID:1272
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"236⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics237⤵PID:1412
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"238⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics239⤵PID:4944
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics"240⤵PID:4312
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1241⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7c371d13aefb5594f50c8d7a8bb03410_NeikiAnalytics241⤵PID:4868
-