Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 13:54
Static task
static1
Behavioral task
behavioral1
Sample
60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe
-
Size
207KB
-
MD5
60b0f8dba7d6a491ccbb27c39385a530
-
SHA1
ea277f3a7ae00ff9cd45d194d6ec441c8eb6336b
-
SHA256
bbefb1de0ee3447c7f5a4fae7bc30efc6ca05b77552b2d379bf9338c8339745a
-
SHA512
a2e82ec32cddc2ffc7964632966a5ae64a1d3b67c2529ead2ebe6c36a87a2fb3f8e9f04c4c36916ef6e275e9d1ec0f29ab319d1bf77b43d6223796c230fe5cb1
-
SSDEEP
3072:I5wprPowTioaigodBG14kIgNwh5XVuZxLyy6LXOQWOW6gqIwEPo7C6ewDbET3:yOQmBG14swh5XVuZxLyFO76UMHH4T3
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (62) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
XwUMskgo.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Control Panel\International\Geo\Nation XwUMskgo.exe -
Executes dropped EXE 2 IoCs
Processes:
XwUMskgo.exeVwocQYoo.exepid process 2996 XwUMskgo.exe 2580 VwocQYoo.exe -
Loads dropped DLL 20 IoCs
Processes:
60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeXwUMskgo.exepid process 2400 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 2400 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 2400 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 2400 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeXwUMskgo.exeVwocQYoo.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\XwUMskgo.exe = "C:\\Users\\Admin\\KSgEAgkw\\XwUMskgo.exe" 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VwocQYoo.exe = "C:\\ProgramData\\aUwggwcA\\VwocQYoo.exe" 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\XwUMskgo.exe = "C:\\Users\\Admin\\KSgEAgkw\\XwUMskgo.exe" XwUMskgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VwocQYoo.exe = "C:\\ProgramData\\aUwggwcA\\VwocQYoo.exe" VwocQYoo.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 2436 reg.exe 1164 reg.exe 2140 reg.exe 1880 reg.exe 1232 reg.exe 1960 reg.exe 2664 reg.exe 1440 reg.exe 2456 reg.exe 2808 reg.exe 1840 reg.exe 1464 reg.exe 1912 reg.exe 2800 reg.exe 2684 reg.exe 1628 reg.exe 1940 reg.exe 2432 reg.exe 1536 reg.exe 1896 reg.exe 1748 reg.exe 624 reg.exe 1896 reg.exe 532 reg.exe 1984 reg.exe 2588 reg.exe 1164 reg.exe 2784 reg.exe 2640 reg.exe 3060 reg.exe 1544 reg.exe 944 reg.exe 2968 reg.exe 1968 reg.exe 1908 reg.exe 2428 reg.exe 2456 reg.exe 2040 reg.exe 1936 reg.exe 2756 reg.exe 2044 reg.exe 2036 reg.exe 2804 reg.exe 996 reg.exe 2092 reg.exe 3036 reg.exe 1900 reg.exe 2708 reg.exe 2352 reg.exe 3036 reg.exe 996 reg.exe 348 reg.exe 2596 reg.exe 2752 reg.exe 2824 reg.exe 1536 reg.exe 1452 reg.exe 2036 reg.exe 2488 reg.exe 348 reg.exe 2032 reg.exe 588 reg.exe 592 reg.exe 2784 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exepid process 2400 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 2400 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 2592 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 2592 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 2796 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 2796 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 480 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 480 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 580 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 580 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 1264 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 1264 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 1432 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 1432 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 2400 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 2400 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 2204 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 2204 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 1932 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 1932 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 2108 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 2108 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 2240 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 2240 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 1072 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 1072 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 1680 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 1680 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 2212 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 2212 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 2932 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 2932 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 2128 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 2128 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 900 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 900 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 1624 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 1624 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 2628 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 2628 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 2824 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 2824 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 1452 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 1452 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 1712 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 1712 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 1120 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 1120 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 1808 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 1808 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 2700 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 2700 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 1216 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 1216 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 1628 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 1628 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 3060 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 3060 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 2424 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 2424 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 1252 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 1252 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 1472 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe 1472 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
XwUMskgo.exepid process 2996 XwUMskgo.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
XwUMskgo.exepid process 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe 2996 XwUMskgo.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.execmd.execmd.exe60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.execmd.execmd.exedescription pid process target process PID 2400 wrote to memory of 2996 2400 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe XwUMskgo.exe PID 2400 wrote to memory of 2996 2400 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe XwUMskgo.exe PID 2400 wrote to memory of 2996 2400 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe XwUMskgo.exe PID 2400 wrote to memory of 2996 2400 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe XwUMskgo.exe PID 2400 wrote to memory of 2580 2400 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe VwocQYoo.exe PID 2400 wrote to memory of 2580 2400 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe VwocQYoo.exe PID 2400 wrote to memory of 2580 2400 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe VwocQYoo.exe PID 2400 wrote to memory of 2580 2400 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe VwocQYoo.exe PID 2400 wrote to memory of 2484 2400 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe cmd.exe PID 2400 wrote to memory of 2484 2400 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe cmd.exe PID 2400 wrote to memory of 2484 2400 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe cmd.exe PID 2400 wrote to memory of 2484 2400 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe cmd.exe PID 2484 wrote to memory of 2592 2484 cmd.exe 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe PID 2484 wrote to memory of 2592 2484 cmd.exe 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe PID 2484 wrote to memory of 2592 2484 cmd.exe 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe PID 2484 wrote to memory of 2592 2484 cmd.exe 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe PID 2400 wrote to memory of 2752 2400 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe reg.exe PID 2400 wrote to memory of 2752 2400 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe reg.exe PID 2400 wrote to memory of 2752 2400 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe reg.exe PID 2400 wrote to memory of 2752 2400 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe reg.exe PID 2400 wrote to memory of 2740 2400 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe reg.exe PID 2400 wrote to memory of 2740 2400 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe reg.exe PID 2400 wrote to memory of 2740 2400 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe reg.exe PID 2400 wrote to memory of 2740 2400 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe reg.exe PID 2400 wrote to memory of 2588 2400 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe reg.exe PID 2400 wrote to memory of 2588 2400 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe reg.exe PID 2400 wrote to memory of 2588 2400 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe reg.exe PID 2400 wrote to memory of 2588 2400 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe reg.exe PID 2400 wrote to memory of 2596 2400 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe cmd.exe PID 2400 wrote to memory of 2596 2400 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe cmd.exe PID 2400 wrote to memory of 2596 2400 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe cmd.exe PID 2400 wrote to memory of 2596 2400 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe cmd.exe PID 2596 wrote to memory of 324 2596 cmd.exe cscript.exe PID 2596 wrote to memory of 324 2596 cmd.exe cscript.exe PID 2596 wrote to memory of 324 2596 cmd.exe cscript.exe PID 2596 wrote to memory of 324 2596 cmd.exe cscript.exe PID 2592 wrote to memory of 2652 2592 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe cmd.exe PID 2592 wrote to memory of 2652 2592 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe cmd.exe PID 2592 wrote to memory of 2652 2592 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe cmd.exe PID 2592 wrote to memory of 2652 2592 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe cmd.exe PID 2652 wrote to memory of 2796 2652 cmd.exe 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe PID 2652 wrote to memory of 2796 2652 cmd.exe 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe PID 2652 wrote to memory of 2796 2652 cmd.exe 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe PID 2652 wrote to memory of 2796 2652 cmd.exe 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe PID 2592 wrote to memory of 752 2592 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe reg.exe PID 2592 wrote to memory of 752 2592 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe reg.exe PID 2592 wrote to memory of 752 2592 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe reg.exe PID 2592 wrote to memory of 752 2592 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe reg.exe PID 2592 wrote to memory of 1536 2592 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe reg.exe PID 2592 wrote to memory of 1536 2592 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe reg.exe PID 2592 wrote to memory of 1536 2592 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe reg.exe PID 2592 wrote to memory of 1536 2592 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe reg.exe PID 2592 wrote to memory of 1908 2592 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe reg.exe PID 2592 wrote to memory of 1908 2592 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe reg.exe PID 2592 wrote to memory of 1908 2592 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe reg.exe PID 2592 wrote to memory of 1908 2592 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe reg.exe PID 2592 wrote to memory of 884 2592 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe cmd.exe PID 2592 wrote to memory of 884 2592 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe cmd.exe PID 2592 wrote to memory of 884 2592 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe cmd.exe PID 2592 wrote to memory of 884 2592 60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe cmd.exe PID 884 wrote to memory of 1228 884 cmd.exe cscript.exe PID 884 wrote to memory of 1228 884 cmd.exe cscript.exe PID 884 wrote to memory of 1228 884 cmd.exe cscript.exe PID 884 wrote to memory of 1228 884 cmd.exe cscript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\KSgEAgkw\XwUMskgo.exe"C:\Users\Admin\KSgEAgkw\XwUMskgo.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\aUwggwcA\VwocQYoo.exe"C:\ProgramData\aUwggwcA\VwocQYoo.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"6⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"8⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"10⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"12⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"14⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"16⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"18⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"20⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"22⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"24⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"26⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"28⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"30⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"32⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"34⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics35⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"36⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics37⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"38⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics39⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"40⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics41⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"42⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics43⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"44⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics45⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"46⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics47⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"48⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics49⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"50⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics51⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"52⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics53⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"54⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics55⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"56⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics57⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"58⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics59⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"60⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics61⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"62⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics63⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"64⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics65⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"66⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics67⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"68⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics69⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"70⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics71⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"72⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics73⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"74⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics75⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"76⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics77⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"78⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics79⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"80⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics81⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"82⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics83⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"84⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics85⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"86⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics87⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"88⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics89⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"90⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics91⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"92⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics93⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"94⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics95⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"96⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics97⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"98⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics99⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"100⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics101⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"102⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics103⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"104⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics105⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"106⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics107⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"108⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics109⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"110⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics111⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"112⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics113⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"114⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics115⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"116⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics117⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"118⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics119⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"120⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics121⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"122⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics123⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"124⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics125⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"126⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics127⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"128⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics129⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"130⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics131⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"132⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics133⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"134⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics135⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"136⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics137⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"138⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics139⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"140⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics141⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"142⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics143⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"144⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics145⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"146⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics147⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"148⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics149⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"150⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics151⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"152⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics153⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"154⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics155⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"156⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics157⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"158⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics159⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"160⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics161⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"162⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics163⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"164⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics165⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"166⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics167⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"168⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics169⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"170⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics171⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"172⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics173⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"174⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics175⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"176⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics177⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"178⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics179⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"180⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics181⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"182⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics183⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"184⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics185⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"186⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics187⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"188⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics189⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"190⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics191⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"192⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics193⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"194⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics195⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"196⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics197⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"198⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics199⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"200⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics201⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"202⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics203⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"204⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics205⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"206⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics207⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"208⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics209⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"210⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics211⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"212⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics213⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"214⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics215⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"216⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics217⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"218⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics219⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"220⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics221⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"222⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics223⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"224⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics225⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"226⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics227⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"228⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics229⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"230⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics231⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"232⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics233⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"234⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics235⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"236⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics237⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"238⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics239⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics"240⤵
-
C:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60b0f8dba7d6a491ccbb27c39385a530_NeikiAnalytics241⤵