Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 17:26
Static task
static1
Behavioral task
behavioral1
Sample
885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe
-
Size
203KB
-
MD5
885b973883a3cc7e02e4b48dde2934f0
-
SHA1
3a2e4704cf0d0d686f90080a50cdefd6571639f7
-
SHA256
f293655d1b7e61d3fc8381c67e8b7504060a32439bbedf5222df3474148c4c29
-
SHA512
d253ad840bbb2421cdde747e9a56d076027e04d98ec69b9690d3057ff7b63f7d6c05ddc663d35a9b3bc89c083be32da6105197ff91dcb7a40c57764e4eb6b7ed
-
SSDEEP
6144:fygM3Hduo0138DxWUzC+XgjbDKXXw8yxs:ukVCxzCBeHw
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (61) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
LAsMsIsc.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Control Panel\International\Geo\Nation LAsMsIsc.exe -
Executes dropped EXE 2 IoCs
Processes:
LAsMsIsc.exeYyoYAEEU.exepid process 1724 LAsMsIsc.exe 2524 YyoYAEEU.exe -
Loads dropped DLL 20 IoCs
Processes:
885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeLAsMsIsc.exepid process 2084 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 2084 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 2084 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 2084 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeLAsMsIsc.exeYyoYAEEU.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\LAsMsIsc.exe = "C:\\Users\\Admin\\mYUMAcwA\\LAsMsIsc.exe" 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\YyoYAEEU.exe = "C:\\ProgramData\\wwgEQIIo\\YyoYAEEU.exe" 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\LAsMsIsc.exe = "C:\\Users\\Admin\\mYUMAcwA\\LAsMsIsc.exe" LAsMsIsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\YyoYAEEU.exe = "C:\\ProgramData\\wwgEQIIo\\YyoYAEEU.exe" YyoYAEEU.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 1692 reg.exe 2316 reg.exe 1896 reg.exe 2844 reg.exe 1076 reg.exe 2392 reg.exe 2664 reg.exe 988 reg.exe 1360 reg.exe 824 reg.exe 2472 reg.exe 2352 reg.exe 1448 reg.exe 2612 reg.exe 2188 reg.exe 960 reg.exe 2840 reg.exe 2428 reg.exe 548 reg.exe 2932 reg.exe 564 reg.exe 1512 reg.exe 1892 reg.exe 452 reg.exe 2020 reg.exe 1936 reg.exe 1076 reg.exe 1800 reg.exe 1436 reg.exe 2472 reg.exe 2548 reg.exe 2156 reg.exe 1956 reg.exe 1612 reg.exe 452 reg.exe 2860 reg.exe 1568 reg.exe 412 reg.exe 1756 reg.exe 2404 reg.exe 2260 reg.exe 1580 reg.exe 1972 reg.exe 584 reg.exe 1652 reg.exe 384 reg.exe 2896 reg.exe 2412 reg.exe 2436 reg.exe 584 reg.exe 2344 reg.exe 2184 reg.exe 2672 reg.exe 1520 reg.exe 2588 reg.exe 1852 reg.exe 3036 reg.exe 2584 reg.exe 1488 reg.exe 2288 reg.exe 848 reg.exe 1912 reg.exe 2952 reg.exe 1128 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exepid process 2084 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 2084 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 2120 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 2120 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 1552 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 1552 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 1660 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 1660 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 488 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 488 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 2924 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 2924 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 2784 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 2784 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 2472 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 2472 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 2572 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 2572 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 1440 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 1440 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 1420 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 1420 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 564 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 564 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 2152 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 2152 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 1112 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 1112 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 2380 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 2380 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 1268 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 1268 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 404 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 404 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 2160 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 2160 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 2564 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 2564 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 2092 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 2092 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 2340 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 2340 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 1684 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 1684 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 1292 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 1292 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 1672 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 1672 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 2088 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 2088 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 2588 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 2588 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 2840 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 2840 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 1520 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 1520 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 792 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 792 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 2956 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 2956 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 1700 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 1700 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 2612 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe 2612 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
LAsMsIsc.exepid process 1724 LAsMsIsc.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
LAsMsIsc.exepid process 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe 1724 LAsMsIsc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.execmd.execmd.exe885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.execmd.execmd.exedescription pid process target process PID 2084 wrote to memory of 1724 2084 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe LAsMsIsc.exe PID 2084 wrote to memory of 1724 2084 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe LAsMsIsc.exe PID 2084 wrote to memory of 1724 2084 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe LAsMsIsc.exe PID 2084 wrote to memory of 1724 2084 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe LAsMsIsc.exe PID 2084 wrote to memory of 2524 2084 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe YyoYAEEU.exe PID 2084 wrote to memory of 2524 2084 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe YyoYAEEU.exe PID 2084 wrote to memory of 2524 2084 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe YyoYAEEU.exe PID 2084 wrote to memory of 2524 2084 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe YyoYAEEU.exe PID 2084 wrote to memory of 2572 2084 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe cmd.exe PID 2084 wrote to memory of 2572 2084 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe cmd.exe PID 2084 wrote to memory of 2572 2084 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe cmd.exe PID 2084 wrote to memory of 2572 2084 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe cmd.exe PID 2572 wrote to memory of 2120 2572 cmd.exe 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe PID 2572 wrote to memory of 2120 2572 cmd.exe 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe PID 2572 wrote to memory of 2120 2572 cmd.exe 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe PID 2572 wrote to memory of 2120 2572 cmd.exe 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe PID 2084 wrote to memory of 2128 2084 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe reg.exe PID 2084 wrote to memory of 2128 2084 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe reg.exe PID 2084 wrote to memory of 2128 2084 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe reg.exe PID 2084 wrote to memory of 2128 2084 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe reg.exe PID 2084 wrote to memory of 2664 2084 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe reg.exe PID 2084 wrote to memory of 2664 2084 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe reg.exe PID 2084 wrote to memory of 2664 2084 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe reg.exe PID 2084 wrote to memory of 2664 2084 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe reg.exe PID 2084 wrote to memory of 2688 2084 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe reg.exe PID 2084 wrote to memory of 2688 2084 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe reg.exe PID 2084 wrote to memory of 2688 2084 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe reg.exe PID 2084 wrote to memory of 2688 2084 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe reg.exe PID 2084 wrote to memory of 2588 2084 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe cmd.exe PID 2084 wrote to memory of 2588 2084 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe cmd.exe PID 2084 wrote to memory of 2588 2084 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe cmd.exe PID 2084 wrote to memory of 2588 2084 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe cmd.exe PID 2588 wrote to memory of 2884 2588 cmd.exe cscript.exe PID 2588 wrote to memory of 2884 2588 cmd.exe cscript.exe PID 2588 wrote to memory of 2884 2588 cmd.exe cscript.exe PID 2588 wrote to memory of 2884 2588 cmd.exe cscript.exe PID 2120 wrote to memory of 1516 2120 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe cmd.exe PID 2120 wrote to memory of 1516 2120 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe cmd.exe PID 2120 wrote to memory of 1516 2120 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe cmd.exe PID 2120 wrote to memory of 1516 2120 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe cmd.exe PID 1516 wrote to memory of 1552 1516 cmd.exe 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe PID 1516 wrote to memory of 1552 1516 cmd.exe 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe PID 1516 wrote to memory of 1552 1516 cmd.exe 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe PID 1516 wrote to memory of 1552 1516 cmd.exe 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe PID 2120 wrote to memory of 1488 2120 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe reg.exe PID 2120 wrote to memory of 1488 2120 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe reg.exe PID 2120 wrote to memory of 1488 2120 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe reg.exe PID 2120 wrote to memory of 1488 2120 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe reg.exe PID 2120 wrote to memory of 2340 2120 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe reg.exe PID 2120 wrote to memory of 2340 2120 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe reg.exe PID 2120 wrote to memory of 2340 2120 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe reg.exe PID 2120 wrote to memory of 2340 2120 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe reg.exe PID 2120 wrote to memory of 332 2120 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe reg.exe PID 2120 wrote to memory of 332 2120 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe reg.exe PID 2120 wrote to memory of 332 2120 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe reg.exe PID 2120 wrote to memory of 332 2120 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe reg.exe PID 2120 wrote to memory of 2320 2120 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe cmd.exe PID 2120 wrote to memory of 2320 2120 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe cmd.exe PID 2120 wrote to memory of 2320 2120 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe cmd.exe PID 2120 wrote to memory of 2320 2120 885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe cmd.exe PID 2320 wrote to memory of 776 2320 cmd.exe cscript.exe PID 2320 wrote to memory of 776 2320 cmd.exe cscript.exe PID 2320 wrote to memory of 776 2320 cmd.exe cscript.exe PID 2320 wrote to memory of 776 2320 cmd.exe cscript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\mYUMAcwA\LAsMsIsc.exe"C:\Users\Admin\mYUMAcwA\LAsMsIsc.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:1724 -
C:\ProgramData\wwgEQIIo\YyoYAEEU.exe"C:\ProgramData\wwgEQIIo\YyoYAEEU.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2524 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"2⤵
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"4⤵
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics5⤵
- Suspicious behavior: EnumeratesProcesses
PID:1552 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"6⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics7⤵
- Suspicious behavior: EnumeratesProcesses
PID:1660 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"8⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics9⤵
- Suspicious behavior: EnumeratesProcesses
PID:488 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"10⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics11⤵
- Suspicious behavior: EnumeratesProcesses
PID:2924 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"12⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics13⤵
- Suspicious behavior: EnumeratesProcesses
PID:2784 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"14⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics15⤵
- Suspicious behavior: EnumeratesProcesses
PID:2472 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"16⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics17⤵
- Suspicious behavior: EnumeratesProcesses
PID:2572 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"18⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics19⤵
- Suspicious behavior: EnumeratesProcesses
PID:1440 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"20⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics21⤵
- Suspicious behavior: EnumeratesProcesses
PID:1420 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"22⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics23⤵
- Suspicious behavior: EnumeratesProcesses
PID:564 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"24⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics25⤵
- Suspicious behavior: EnumeratesProcesses
PID:2152 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"26⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics27⤵
- Suspicious behavior: EnumeratesProcesses
PID:1112 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"28⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics29⤵
- Suspicious behavior: EnumeratesProcesses
PID:2380 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"30⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics31⤵
- Suspicious behavior: EnumeratesProcesses
PID:1268 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"32⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics33⤵
- Suspicious behavior: EnumeratesProcesses
PID:404 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"34⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics35⤵
- Suspicious behavior: EnumeratesProcesses
PID:2160 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"36⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics37⤵
- Suspicious behavior: EnumeratesProcesses
PID:2564 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"38⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics39⤵
- Suspicious behavior: EnumeratesProcesses
PID:2092 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"40⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics41⤵
- Suspicious behavior: EnumeratesProcesses
PID:2340 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"42⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics43⤵
- Suspicious behavior: EnumeratesProcesses
PID:1684 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"44⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics45⤵
- Suspicious behavior: EnumeratesProcesses
PID:1292 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"46⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics47⤵
- Suspicious behavior: EnumeratesProcesses
PID:1672 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"48⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics49⤵
- Suspicious behavior: EnumeratesProcesses
PID:2088 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"50⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics51⤵
- Suspicious behavior: EnumeratesProcesses
PID:2588 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"52⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics53⤵
- Suspicious behavior: EnumeratesProcesses
PID:2840 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"54⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics55⤵
- Suspicious behavior: EnumeratesProcesses
PID:1520 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"56⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics57⤵
- Suspicious behavior: EnumeratesProcesses
PID:792 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"58⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics59⤵
- Suspicious behavior: EnumeratesProcesses
PID:2956 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"60⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics61⤵
- Suspicious behavior: EnumeratesProcesses
PID:1700 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"62⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics63⤵
- Suspicious behavior: EnumeratesProcesses
PID:2612 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"64⤵PID:280
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics65⤵PID:2588
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"66⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics67⤵PID:2208
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"68⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics69⤵PID:2972
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"70⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics71⤵PID:2516
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"72⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics73⤵PID:2544
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"74⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics75⤵PID:2808
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"76⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics77⤵PID:240
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"78⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics79⤵PID:1652
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"80⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics81⤵PID:2452
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"82⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics83⤵PID:1632
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"84⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics85⤵PID:920
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"86⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics87⤵PID:2084
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"88⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics89⤵PID:2316
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"90⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics91⤵PID:2320
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"92⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics93⤵PID:540
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"94⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics95⤵PID:2148
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"96⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics97⤵PID:2504
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"98⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics99⤵PID:708
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"100⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics101⤵PID:2940
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"102⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics103⤵PID:1668
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"104⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics105⤵PID:2228
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"106⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics107⤵PID:1436
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"108⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics109⤵PID:564
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"110⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics111⤵PID:1748
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"112⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics113⤵PID:540
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"114⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics115⤵PID:2188
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"116⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics117⤵PID:1612
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"118⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics119⤵PID:936
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"120⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics121⤵PID:628
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"122⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics123⤵PID:1368
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"124⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics125⤵PID:3012
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"126⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics127⤵PID:540
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"128⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics129⤵PID:2548
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"130⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics131⤵PID:1456
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"132⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics133⤵PID:2396
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"134⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics135⤵PID:328
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"136⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics137⤵PID:2020
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"138⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics139⤵PID:2480
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"140⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics141⤵PID:1196
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"142⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics143⤵PID:1856
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"144⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics145⤵PID:2372
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"146⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics147⤵PID:3012
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"148⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics149⤵PID:240
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"150⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics151⤵PID:1636
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"152⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics153⤵PID:1752
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"154⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics155⤵PID:2068
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"156⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics157⤵PID:1956
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"158⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics159⤵PID:1268
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"160⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics161⤵PID:1880
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"162⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics163⤵PID:1960
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"164⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics165⤵PID:2588
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"166⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics167⤵PID:1268
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"168⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics169⤵PID:2852
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"170⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics171⤵PID:2260
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"172⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics173⤵PID:1304
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"174⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics175⤵PID:2208
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"176⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics177⤵PID:1580
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"178⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics179⤵PID:1568
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"180⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics181⤵PID:1892
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"182⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics183⤵PID:1744
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"184⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics185⤵PID:2944
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"186⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics187⤵PID:1548
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"188⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics189⤵PID:1804
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"190⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics191⤵PID:1880
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"192⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics193⤵PID:2984
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"194⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics195⤵PID:1360
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"196⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics197⤵PID:2208
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"198⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics199⤵PID:2784
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"200⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics201⤵PID:868
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"202⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics203⤵PID:808
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"204⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics205⤵PID:1000
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"206⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics207⤵PID:1876
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"208⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics209⤵PID:1892
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"210⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics211⤵PID:2980
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"212⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics213⤵PID:884
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"214⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics215⤵PID:1668
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"216⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics217⤵PID:708
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"218⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics219⤵PID:2536
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"220⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics221⤵PID:2816
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"222⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics223⤵PID:2016
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"224⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics225⤵PID:2420
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"226⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics227⤵PID:2232
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"228⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics229⤵PID:2008
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"230⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics231⤵PID:2652
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"232⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics233⤵PID:2540
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"234⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics235⤵PID:1904
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"236⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics237⤵PID:2916
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"238⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics239⤵PID:3040
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics"240⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\885b973883a3cc7e02e4b48dde2934f0_NeikiAnalytics241⤵PID:2620
-