Analysis
-
max time kernel
150s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 19:06
Static task
static1
Behavioral task
behavioral1
Sample
7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe
-
Size
235KB
-
MD5
7f95cf32a59866c35a58d6f539fbbc20
-
SHA1
c960424a29b594006b9b0486a20f2557c5572396
-
SHA256
1205b73473f33d45d4f89d60ec8e6e1ae6e05446f52ac4f0149e3f26fdb52d96
-
SHA512
8f87e3a30da21ae858cf5a676f6c6cc908a581bd552b9f86a2c2f15f0f4dd53413aed30fd2dd92979fe15209ed12f8a82acc9a8c687c1436ac5a34bc435ba994
-
SSDEEP
6144:IFMgyAI9DHBEwWGD+o/uWhxwkJxu9SJ3CCYxSn6tou:LgyAI9DHBEwjT/rHxu4Yg6to
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (77) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
CaAIkkUI.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation CaAIkkUI.exe -
Executes dropped EXE 2 IoCs
Processes:
CaAIkkUI.exejoYEQwIQ.exepid process 4320 CaAIkkUI.exe 4740 joYEQwIQ.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeCaAIkkUI.exejoYEQwIQ.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CaAIkkUI.exe = "C:\\Users\\Admin\\FMgckMUk\\CaAIkkUI.exe" 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\joYEQwIQ.exe = "C:\\ProgramData\\SeAQgscE\\joYEQwIQ.exe" 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CaAIkkUI.exe = "C:\\Users\\Admin\\FMgckMUk\\CaAIkkUI.exe" CaAIkkUI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\joYEQwIQ.exe = "C:\\ProgramData\\SeAQgscE\\joYEQwIQ.exe" joYEQwIQ.exe -
Drops file in System32 directory 2 IoCs
Processes:
CaAIkkUI.exedescription ioc process File created C:\Windows\SysWOW64\shell32.dll.exe CaAIkkUI.exe File opened for modification C:\Windows\SysWOW64\shell32.dll.exe CaAIkkUI.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 2580 reg.exe 4876 reg.exe 5044 reg.exe 744 reg.exe 3004 reg.exe 4444 2880 2444 reg.exe 2804 reg.exe 3988 reg.exe 5044 reg.exe 1492 reg.exe 4328 reg.exe 3992 reg.exe 1144 reg.exe 2428 reg.exe 3900 reg.exe 4620 reg.exe 5024 reg.exe 2880 reg.exe 4712 reg.exe 4156 3332 reg.exe 456 reg.exe 744 2908 reg.exe 2576 reg.exe 3492 reg.exe 1600 reg.exe 2428 reg.exe 3064 reg.exe 4156 reg.exe 2948 1816 reg.exe 3280 reg.exe 1576 reg.exe 4212 reg.exe 2980 reg.exe 2192 reg.exe 2324 reg.exe 1492 reg.exe 3936 reg.exe 1828 reg.exe 4728 reg.exe 1076 reg.exe 1004 reg.exe 2140 reg.exe 1004 reg.exe 1928 reg.exe 3332 reg.exe 3076 4824 3960 reg.exe 3936 reg.exe 3248 reg.exe 3988 reg.exe 776 reg.exe 4172 reg.exe 708 1784 reg.exe 5056 reg.exe 3492 reg.exe 1376 reg.exe 4824 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exepid process 3760 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 3760 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 3760 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 3760 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 3492 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 3492 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 3492 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 3492 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 2104 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 2104 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 2104 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 2104 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 1848 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 1848 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 1848 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 1848 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 2852 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 2852 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 2852 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 2852 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 404 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 404 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 404 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 404 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 3912 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 3912 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 3912 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 3912 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 776 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 776 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 776 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 776 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 3824 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 3824 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 3824 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 3824 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 2900 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 2900 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 2900 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 2900 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 2104 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 2104 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 2104 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 2104 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 3060 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 3060 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 3060 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 3060 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 464 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 464 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 464 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 464 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 4516 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 4516 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 4516 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 4516 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 4552 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 4552 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 4552 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 4552 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 2240 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 2240 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 2240 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe 2240 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
CaAIkkUI.exepid process 4320 CaAIkkUI.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
CaAIkkUI.exepid process 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe 4320 CaAIkkUI.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.execmd.execmd.exe7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.execmd.execmd.exe7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.execmd.exedescription pid process target process PID 3760 wrote to memory of 4320 3760 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe CaAIkkUI.exe PID 3760 wrote to memory of 4320 3760 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe CaAIkkUI.exe PID 3760 wrote to memory of 4320 3760 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe CaAIkkUI.exe PID 3760 wrote to memory of 4740 3760 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe joYEQwIQ.exe PID 3760 wrote to memory of 4740 3760 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe joYEQwIQ.exe PID 3760 wrote to memory of 4740 3760 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe joYEQwIQ.exe PID 3760 wrote to memory of 5068 3760 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe cmd.exe PID 3760 wrote to memory of 5068 3760 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe cmd.exe PID 3760 wrote to memory of 5068 3760 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe cmd.exe PID 5068 wrote to memory of 3492 5068 cmd.exe 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe PID 5068 wrote to memory of 3492 5068 cmd.exe 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe PID 5068 wrote to memory of 3492 5068 cmd.exe 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe PID 3760 wrote to memory of 3204 3760 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe reg.exe PID 3760 wrote to memory of 3204 3760 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe reg.exe PID 3760 wrote to memory of 3204 3760 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe reg.exe PID 3760 wrote to memory of 1560 3760 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe reg.exe PID 3760 wrote to memory of 1560 3760 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe reg.exe PID 3760 wrote to memory of 1560 3760 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe reg.exe PID 3760 wrote to memory of 1784 3760 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe reg.exe PID 3760 wrote to memory of 1784 3760 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe reg.exe PID 3760 wrote to memory of 1784 3760 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe reg.exe PID 3760 wrote to memory of 4744 3760 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe cmd.exe PID 3760 wrote to memory of 4744 3760 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe cmd.exe PID 3760 wrote to memory of 4744 3760 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe cmd.exe PID 4744 wrote to memory of 676 4744 cmd.exe cscript.exe PID 4744 wrote to memory of 676 4744 cmd.exe cscript.exe PID 4744 wrote to memory of 676 4744 cmd.exe cscript.exe PID 3492 wrote to memory of 1196 3492 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe cmd.exe PID 3492 wrote to memory of 1196 3492 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe cmd.exe PID 3492 wrote to memory of 1196 3492 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe cmd.exe PID 1196 wrote to memory of 2104 1196 cmd.exe 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe PID 1196 wrote to memory of 2104 1196 cmd.exe 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe PID 1196 wrote to memory of 2104 1196 cmd.exe 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe PID 3492 wrote to memory of 3528 3492 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe reg.exe PID 3492 wrote to memory of 3528 3492 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe reg.exe PID 3492 wrote to memory of 3528 3492 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe reg.exe PID 3492 wrote to memory of 3060 3492 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe reg.exe PID 3492 wrote to memory of 3060 3492 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe reg.exe PID 3492 wrote to memory of 3060 3492 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe reg.exe PID 3492 wrote to memory of 5024 3492 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe reg.exe PID 3492 wrote to memory of 5024 3492 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe reg.exe PID 3492 wrote to memory of 5024 3492 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe reg.exe PID 3492 wrote to memory of 1968 3492 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe cmd.exe PID 3492 wrote to memory of 1968 3492 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe cmd.exe PID 3492 wrote to memory of 1968 3492 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe cmd.exe PID 1968 wrote to memory of 1096 1968 cmd.exe cscript.exe PID 1968 wrote to memory of 1096 1968 cmd.exe cscript.exe PID 1968 wrote to memory of 1096 1968 cmd.exe cscript.exe PID 2104 wrote to memory of 1124 2104 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe cmd.exe PID 2104 wrote to memory of 1124 2104 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe cmd.exe PID 2104 wrote to memory of 1124 2104 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe cmd.exe PID 1124 wrote to memory of 1848 1124 cmd.exe 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe PID 1124 wrote to memory of 1848 1124 cmd.exe 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe PID 1124 wrote to memory of 1848 1124 cmd.exe 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe PID 2104 wrote to memory of 5056 2104 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe reg.exe PID 2104 wrote to memory of 5056 2104 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe reg.exe PID 2104 wrote to memory of 5056 2104 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe reg.exe PID 2104 wrote to memory of 2528 2104 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe reg.exe PID 2104 wrote to memory of 2528 2104 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe reg.exe PID 2104 wrote to memory of 2528 2104 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe reg.exe PID 2104 wrote to memory of 1488 2104 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe reg.exe PID 2104 wrote to memory of 1488 2104 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe reg.exe PID 2104 wrote to memory of 1488 2104 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe reg.exe PID 2104 wrote to memory of 4264 2104 7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\FMgckMUk\CaAIkkUI.exe"C:\Users\Admin\FMgckMUk\CaAIkkUI.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\SeAQgscE\joYEQwIQ.exe"C:\ProgramData\SeAQgscE\joYEQwIQ.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"8⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"10⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"12⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"14⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"16⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"18⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"20⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"22⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"24⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"26⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"28⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"30⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV131⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"32⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"34⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"36⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"38⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"40⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"42⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"44⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"46⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"48⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"50⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"52⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"54⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV155⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"56⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"58⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"60⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV161⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"62⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"64⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"66⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"68⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"70⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics71⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"72⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics73⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"74⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"76⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV177⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics77⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"78⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics79⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"80⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV181⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics81⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"82⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics83⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"84⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics85⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"86⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics87⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"88⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV189⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics89⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"90⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"92⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics93⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"94⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV195⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics95⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"96⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV197⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics97⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"98⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics99⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"100⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics101⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"102⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics103⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"104⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics105⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"106⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics107⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"108⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics109⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"110⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics111⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"112⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics113⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"114⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics115⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"116⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics117⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"118⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics119⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"120⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics121⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"122⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics123⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"124⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics125⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"126⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1127⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics127⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"128⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics129⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"130⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics131⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"132⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics133⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"134⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics135⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"136⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics137⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"138⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics139⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"140⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics141⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"142⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics143⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"144⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics145⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"146⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics147⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"148⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics149⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"150⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics151⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"152⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics153⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"154⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1155⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics155⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"156⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1157⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics157⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"158⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics159⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"160⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1161⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics161⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"162⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1163⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics163⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"164⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics165⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"166⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics167⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"168⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics169⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"170⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics171⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"172⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics173⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"174⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics175⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"176⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1177⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics177⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"178⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics179⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"180⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics181⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"182⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics183⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"184⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics185⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"186⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics187⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"188⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics189⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"190⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics191⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"192⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics193⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"194⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1195⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics195⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"196⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics197⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"198⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics199⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"200⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1201⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics201⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"202⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics203⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"204⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1205⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics205⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"206⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics207⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"208⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics209⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"210⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics211⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"212⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics213⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"214⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics215⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"216⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics217⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"218⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics219⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"220⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics221⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"222⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1223⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics223⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"224⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics225⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"226⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics227⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"228⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics229⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"230⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics231⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"232⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1233⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics233⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"234⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics235⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"236⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1237⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics237⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"238⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1239⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics239⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics"240⤵
-
C:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\7f95cf32a59866c35a58d6f539fbbc20_NeikiAnalytics241⤵