Analysis
-
max time kernel
150s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 14:10
Static task
static1
Behavioral task
behavioral1
Sample
806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe
-
Size
193KB
-
MD5
806b9f92a4464a291ac1d8e90b08ed40
-
SHA1
cf11aee71eff829a95c35516931f9e19fffeca90
-
SHA256
ee8158658a88379ae33403b0ed8637e37e9581f2a1e8f72f42f4f9543e976769
-
SHA512
e70c2e6b19c237b7d77b1caded33f2f107e4b60133fb5c8c5d762f2cdd0a51495ba98c18cf62d7a406a7dc8eab745ba0ca7c43ca58ee5f3e227ce032aafb4fdc
-
SSDEEP
3072:E50o9vw26xczqINKYbJ487jeUyu7aCszXFHr63INiNUnQHC9qDmur+:TW7OMKSt3aCAXFHhiKnQi9qzr
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (82) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
tKUkIYMQ.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation tKUkIYMQ.exe -
Executes dropped EXE 2 IoCs
Processes:
tKUkIYMQ.exeuIYscwkg.exepid process 2704 tKUkIYMQ.exe 2308 uIYscwkg.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
uIYscwkg.exe806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exetKUkIYMQ.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uIYscwkg.exe = "C:\\ProgramData\\EsgQkYsg\\uIYscwkg.exe" uIYscwkg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kYAQcYow.exe = "C:\\Users\\Admin\\UyAgEcoo\\kYAQcYow.exe" 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\owEMYEoY.exe = "C:\\ProgramData\\cuMYwIcU\\owEMYEoY.exe" 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tKUkIYMQ.exe = "C:\\Users\\Admin\\fqcIwIsE\\tKUkIYMQ.exe" 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uIYscwkg.exe = "C:\\ProgramData\\EsgQkYsg\\uIYscwkg.exe" 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tKUkIYMQ.exe = "C:\\Users\\Admin\\fqcIwIsE\\tKUkIYMQ.exe" tKUkIYMQ.exe -
Drops file in System32 directory 2 IoCs
Processes:
tKUkIYMQ.exedescription ioc process File created C:\Windows\SysWOW64\shell32.dll.exe tKUkIYMQ.exe File opened for modification C:\Windows\SysWOW64\shell32.dll.exe tKUkIYMQ.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3944 1444 WerFault.exe kYAQcYow.exe 3984 4448 WerFault.exe owEMYEoY.exe -
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 2740 reg.exe 2608 reg.exe 1584 reg.exe 2884 reg.exe 2712 reg.exe 4548 reg.exe 3428 reg.exe 5076 reg.exe 4468 reg.exe 2452 reg.exe 5076 reg.exe 1272 reg.exe 2492 reg.exe 1936 reg.exe 976 1216 reg.exe 3332 reg.exe 332 reg.exe 1348 reg.exe 3856 reg.exe 2260 reg.exe 1392 reg.exe 2124 reg.exe 4960 reg.exe 5000 1920 3244 reg.exe 2964 reg.exe 3012 reg.exe 4100 5000 reg.exe 5112 reg.exe 780 reg.exe 3368 reg.exe 4864 reg.exe 4156 632 reg.exe 3428 reg.exe 4132 1304 reg.exe 4476 reg.exe 3704 reg.exe 4156 2884 740 reg.exe 3936 reg.exe 4492 reg.exe 4512 1752 reg.exe 4344 reg.exe 4636 reg.exe 4444 reg.exe 4480 4700 reg.exe 2608 reg.exe 1308 reg.exe 2036 reg.exe 4532 reg.exe 1496 1672 reg.exe 4524 reg.exe 4156 reg.exe 728 3412 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exepid process 4864 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 4864 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 4864 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 4864 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 4336 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 4336 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 4336 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 4336 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 3416 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 3416 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 3416 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 3416 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 552 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 552 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 552 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 552 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 364 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 364 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 364 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 364 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 2408 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 2408 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 2408 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 2408 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 560 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 560 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 560 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 560 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 3856 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 3856 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 3856 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 3856 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 4580 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 4580 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 4580 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 4580 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 392 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 392 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 392 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 392 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 736 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 736 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 736 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 736 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 3016 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 3016 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 3016 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 3016 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 1148 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 1148 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 1148 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 1148 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 4580 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 4580 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 4580 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 4580 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 4408 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 4408 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 4408 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 4408 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 4796 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 4796 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 4796 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe 4796 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
tKUkIYMQ.exepid process 2704 tKUkIYMQ.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
tKUkIYMQ.exepid process 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe 2704 tKUkIYMQ.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.execmd.exe806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.execmd.execmd.execmd.exe806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.execmd.exedescription pid process target process PID 4864 wrote to memory of 2704 4864 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe tKUkIYMQ.exe PID 4864 wrote to memory of 2704 4864 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe tKUkIYMQ.exe PID 4864 wrote to memory of 2704 4864 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe tKUkIYMQ.exe PID 4864 wrote to memory of 2308 4864 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe uIYscwkg.exe PID 4864 wrote to memory of 2308 4864 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe uIYscwkg.exe PID 4864 wrote to memory of 2308 4864 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe uIYscwkg.exe PID 4864 wrote to memory of 4304 4864 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe cmd.exe PID 4864 wrote to memory of 4304 4864 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe cmd.exe PID 4864 wrote to memory of 4304 4864 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe cmd.exe PID 4304 wrote to memory of 4336 4304 cmd.exe 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe PID 4304 wrote to memory of 4336 4304 cmd.exe 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe PID 4304 wrote to memory of 4336 4304 cmd.exe 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe PID 4864 wrote to memory of 2608 4864 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe reg.exe PID 4864 wrote to memory of 2608 4864 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe reg.exe PID 4864 wrote to memory of 2608 4864 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe reg.exe PID 4864 wrote to memory of 4640 4864 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe reg.exe PID 4864 wrote to memory of 4640 4864 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe reg.exe PID 4864 wrote to memory of 4640 4864 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe reg.exe PID 4864 wrote to memory of 512 4864 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe reg.exe PID 4864 wrote to memory of 512 4864 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe reg.exe PID 4864 wrote to memory of 512 4864 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe reg.exe PID 4864 wrote to memory of 1784 4864 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe cmd.exe PID 4864 wrote to memory of 1784 4864 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe cmd.exe PID 4864 wrote to memory of 1784 4864 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe cmd.exe PID 4336 wrote to memory of 1820 4336 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe cmd.exe PID 4336 wrote to memory of 1820 4336 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe cmd.exe PID 4336 wrote to memory of 1820 4336 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe cmd.exe PID 1784 wrote to memory of 3856 1784 cmd.exe cscript.exe PID 1784 wrote to memory of 3856 1784 cmd.exe cscript.exe PID 1784 wrote to memory of 3856 1784 cmd.exe cscript.exe PID 1820 wrote to memory of 3416 1820 cmd.exe 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe PID 1820 wrote to memory of 3416 1820 cmd.exe 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe PID 1820 wrote to memory of 3416 1820 cmd.exe 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe PID 4336 wrote to memory of 1996 4336 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe reg.exe PID 4336 wrote to memory of 1996 4336 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe reg.exe PID 4336 wrote to memory of 1996 4336 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe reg.exe PID 4336 wrote to memory of 4700 4336 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe reg.exe PID 4336 wrote to memory of 4700 4336 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe reg.exe PID 4336 wrote to memory of 4700 4336 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe reg.exe PID 4336 wrote to memory of 2304 4336 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe reg.exe PID 4336 wrote to memory of 2304 4336 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe reg.exe PID 4336 wrote to memory of 2304 4336 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe reg.exe PID 4336 wrote to memory of 1932 4336 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe cmd.exe PID 4336 wrote to memory of 1932 4336 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe cmd.exe PID 4336 wrote to memory of 1932 4336 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe cmd.exe PID 1932 wrote to memory of 436 1932 cmd.exe cscript.exe PID 1932 wrote to memory of 436 1932 cmd.exe cscript.exe PID 1932 wrote to memory of 436 1932 cmd.exe cscript.exe PID 3416 wrote to memory of 4808 3416 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe cmd.exe PID 3416 wrote to memory of 4808 3416 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe cmd.exe PID 3416 wrote to memory of 4808 3416 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe cmd.exe PID 4808 wrote to memory of 552 4808 cmd.exe 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe PID 4808 wrote to memory of 552 4808 cmd.exe 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe PID 4808 wrote to memory of 552 4808 cmd.exe 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe PID 3416 wrote to memory of 1148 3416 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe reg.exe PID 3416 wrote to memory of 1148 3416 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe reg.exe PID 3416 wrote to memory of 1148 3416 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe reg.exe PID 3416 wrote to memory of 4880 3416 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe reg.exe PID 3416 wrote to memory of 4880 3416 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe reg.exe PID 3416 wrote to memory of 4880 3416 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe reg.exe PID 3416 wrote to memory of 840 3416 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe reg.exe PID 3416 wrote to memory of 840 3416 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe reg.exe PID 3416 wrote to memory of 840 3416 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe reg.exe PID 3416 wrote to memory of 4056 3416 806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\fqcIwIsE\tKUkIYMQ.exe"C:\Users\Admin\fqcIwIsE\tKUkIYMQ.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\EsgQkYsg\uIYscwkg.exe"C:\ProgramData\EsgQkYsg\uIYscwkg.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"8⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"10⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"12⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"14⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"16⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"18⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV119⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"20⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"22⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"24⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"26⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"28⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"30⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"32⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"34⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"36⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV137⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"38⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"40⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"42⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"44⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"46⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"48⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"50⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV151⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"52⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"54⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"56⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"58⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"60⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"62⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"64⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"66⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"68⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"70⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics71⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"72⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV173⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics73⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"74⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"76⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics77⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"78⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics79⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"80⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics81⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"82⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics83⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"84⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV185⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics85⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"86⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV187⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics87⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"88⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV189⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics89⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"90⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"92⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics93⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"94⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics95⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"96⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV197⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics97⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"98⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics99⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"100⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics101⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"102⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics103⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"104⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics105⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"106⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics107⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"108⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics109⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"110⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics111⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"112⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics113⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"114⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics115⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"116⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics117⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"118⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1119⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics119⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"120⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics121⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"122⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics123⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"124⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics125⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"126⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics127⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"128⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics129⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"130⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics131⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"132⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics133⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"134⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics135⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"136⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics137⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"138⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics139⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"140⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics141⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"142⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics143⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"144⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics145⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"146⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics147⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"148⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1149⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics149⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"150⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics151⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"152⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics153⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"154⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1155⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics155⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"156⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics157⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"158⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics159⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"160⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1161⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics161⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"162⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics163⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"164⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics165⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"166⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics167⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"168⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics169⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"170⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1171⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics171⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"172⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics173⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"174⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1175⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics175⤵
- Adds Run key to start application
-
C:\Users\Admin\UyAgEcoo\kYAQcYow.exe"C:\Users\Admin\UyAgEcoo\kYAQcYow.exe"176⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1444 -s 224177⤵
- Program crash
-
C:\ProgramData\cuMYwIcU\owEMYEoY.exe"C:\ProgramData\cuMYwIcU\owEMYEoY.exe"176⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 224177⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"176⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics177⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"178⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1179⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics179⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"180⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics181⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"182⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics183⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"184⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics185⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"186⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1187⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics187⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"188⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics189⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"190⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics191⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"192⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics193⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"194⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics195⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"196⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics197⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"198⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics199⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"200⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1201⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics201⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"202⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics203⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"204⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1205⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics205⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"206⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics207⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"208⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics209⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"210⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics211⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"212⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics213⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"214⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics215⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"216⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics217⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"218⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics219⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"220⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics221⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"222⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics223⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"224⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics225⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"226⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics227⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"228⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1229⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics229⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"230⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics231⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"232⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics233⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"234⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics235⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"236⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics237⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"238⤵
-
C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics239⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\806b9f92a4464a291ac1d8e90b08ed40_NeikiAnalytics"240⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1241⤵