Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 17:50
Static task
static1
Behavioral task
behavioral1
Sample
d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe
-
Size
184KB
-
MD5
d165263328a22c1a3e486b0b6d01c830
-
SHA1
6081f6feee7d83e214259ab526b85916e26b8550
-
SHA256
9ca6c01ef00c193e3c33e47f3912981ac30d226fb1af8c4b49cbf2184dcc19e0
-
SHA512
bf49529b357bc1e4ac6a5b13ffe822674de4e2aaf9181435b28c5c07c8e080abdfc99721324685238e913b534a63d92152c5f75eef6f77dfb36273948e853f00
-
SSDEEP
3072:yswQYf3xmbkA5+K1gt7aMyeplsLcTYk0TpxueMD16ZGCjOzj0au9z2+I:SzfhmbulsLyYk0Yp82+I
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (55) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ACsggEUw.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\International\Geo\Nation ACsggEUw.exe -
Executes dropped EXE 2 IoCs
Processes:
ACsggEUw.exetaIkUUIc.exepid process 1580 ACsggEUw.exe 2040 taIkUUIc.exe -
Loads dropped DLL 20 IoCs
Processes:
d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeACsggEUw.exepid process 2168 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 2168 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 2168 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 2168 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeACsggEUw.exetaIkUUIc.exed165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\ACsggEUw.exe = "C:\\Users\\Admin\\AEkUcoos\\ACsggEUw.exe" d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\taIkUUIc.exe = "C:\\ProgramData\\CcEAUUcc\\taIkUUIc.exe" d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\ACsggEUw.exe = "C:\\Users\\Admin\\AEkUcoos\\ACsggEUw.exe" ACsggEUw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\taIkUUIc.exe = "C:\\ProgramData\\CcEAUUcc\\taIkUUIc.exe" taIkUUIc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\sqUoMkUo.exe = "C:\\Users\\Admin\\JAIcUMUw\\sqUoMkUo.exe" d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SAQEEEAo.exe = "C:\\ProgramData\\Ucscscog\\SAQEEEAo.exe" d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe -
Drops file in Windows directory 1 IoCs
Processes:
ACsggEUw.exedescription ioc process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico ACsggEUw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2372 2344 WerFault.exe sqUoMkUo.exe 1076 2848 WerFault.exe cmd.exe -
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 2684 reg.exe 1736 reg.exe 2700 reg.exe 1644 reg.exe 2528 reg.exe 2816 reg.exe 772 reg.exe 2752 reg.exe 2304 reg.exe 2708 reg.exe 1064 reg.exe 1744 reg.exe 2708 reg.exe 1664 reg.exe 1920 reg.exe 2676 reg.exe 932 reg.exe 2380 reg.exe 2524 reg.exe 1244 reg.exe 1196 reg.exe 1500 reg.exe 2012 reg.exe 1576 reg.exe 328 reg.exe 1856 reg.exe 2252 reg.exe 2464 reg.exe 2128 reg.exe 2724 reg.exe 2612 reg.exe 1864 reg.exe 2456 reg.exe 3016 reg.exe 3008 reg.exe 1488 reg.exe 2388 reg.exe 2432 reg.exe 2880 reg.exe 700 reg.exe 1804 reg.exe 1912 reg.exe 2712 reg.exe 1424 reg.exe 2104 reg.exe 1588 reg.exe 1228 reg.exe 348 reg.exe 3000 reg.exe 2176 reg.exe 1996 reg.exe 2452 reg.exe 2836 reg.exe 1520 reg.exe 452 reg.exe 2212 reg.exe 844 reg.exe 1228 reg.exe 3016 reg.exe 604 reg.exe 2036 reg.exe 2252 reg.exe 1000 reg.exe 2572 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exed165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exed165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exed165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exed165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exed165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exed165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exed165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exed165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exed165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exed165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exed165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exed165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exed165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exed165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exed165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exed165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exed165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exed165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exed165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exed165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exed165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exed165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exed165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exed165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exed165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exed165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exed165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exed165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exed165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exed165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exed165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exepid process 2168 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 2168 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 2684 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 2684 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 3016 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 3016 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 804 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 804 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 480 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 480 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 1064 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 1064 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 2848 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 2848 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 2712 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 2712 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 1808 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 1808 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 2992 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 2992 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 1256 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 1256 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 784 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 784 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 1508 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 1508 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 1800 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 1800 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 2772 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 2772 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 1236 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 1236 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 1748 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 1748 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 2308 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 2308 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 2224 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 2224 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 2412 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 2412 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 1648 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 1648 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 988 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 988 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 1300 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 1300 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 1572 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 1572 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 2616 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 2616 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 2824 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 2824 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 2748 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 2748 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 2736 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 2736 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 328 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 328 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 2376 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 2376 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 2604 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 2604 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 2864 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe 2864 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
ACsggEUw.exepid process 1580 ACsggEUw.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
ACsggEUw.exepid process 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe 1580 ACsggEUw.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.execmd.execmd.exed165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.execmd.execmd.exedescription pid process target process PID 2168 wrote to memory of 1580 2168 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe ACsggEUw.exe PID 2168 wrote to memory of 1580 2168 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe ACsggEUw.exe PID 2168 wrote to memory of 1580 2168 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe ACsggEUw.exe PID 2168 wrote to memory of 1580 2168 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe ACsggEUw.exe PID 2168 wrote to memory of 2040 2168 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe taIkUUIc.exe PID 2168 wrote to memory of 2040 2168 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe taIkUUIc.exe PID 2168 wrote to memory of 2040 2168 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe taIkUUIc.exe PID 2168 wrote to memory of 2040 2168 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe taIkUUIc.exe PID 2168 wrote to memory of 2608 2168 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe cmd.exe PID 2168 wrote to memory of 2608 2168 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe cmd.exe PID 2168 wrote to memory of 2608 2168 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe cmd.exe PID 2168 wrote to memory of 2608 2168 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe cmd.exe PID 2608 wrote to memory of 2684 2608 cmd.exe d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe PID 2608 wrote to memory of 2684 2608 cmd.exe d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe PID 2608 wrote to memory of 2684 2608 cmd.exe d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe PID 2608 wrote to memory of 2684 2608 cmd.exe d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe PID 2168 wrote to memory of 2420 2168 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe reg.exe PID 2168 wrote to memory of 2420 2168 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe reg.exe PID 2168 wrote to memory of 2420 2168 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe reg.exe PID 2168 wrote to memory of 2420 2168 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe reg.exe PID 2168 wrote to memory of 2532 2168 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe reg.exe PID 2168 wrote to memory of 2532 2168 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe reg.exe PID 2168 wrote to memory of 2532 2168 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe reg.exe PID 2168 wrote to memory of 2532 2168 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe reg.exe PID 2168 wrote to memory of 2708 2168 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe reg.exe PID 2168 wrote to memory of 2708 2168 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe reg.exe PID 2168 wrote to memory of 2708 2168 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe reg.exe PID 2168 wrote to memory of 2708 2168 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe reg.exe PID 2168 wrote to memory of 2456 2168 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe cmd.exe PID 2168 wrote to memory of 2456 2168 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe cmd.exe PID 2168 wrote to memory of 2456 2168 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe cmd.exe PID 2168 wrote to memory of 2456 2168 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe cmd.exe PID 2456 wrote to memory of 356 2456 cmd.exe cscript.exe PID 2456 wrote to memory of 356 2456 cmd.exe cscript.exe PID 2456 wrote to memory of 356 2456 cmd.exe cscript.exe PID 2456 wrote to memory of 356 2456 cmd.exe cscript.exe PID 2684 wrote to memory of 2948 2684 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe cmd.exe PID 2684 wrote to memory of 2948 2684 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe cmd.exe PID 2684 wrote to memory of 2948 2684 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe cmd.exe PID 2684 wrote to memory of 2948 2684 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe cmd.exe PID 2948 wrote to memory of 3016 2948 cmd.exe d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe PID 2948 wrote to memory of 3016 2948 cmd.exe d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe PID 2948 wrote to memory of 3016 2948 cmd.exe d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe PID 2948 wrote to memory of 3016 2948 cmd.exe d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe PID 2684 wrote to memory of 2452 2684 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe reg.exe PID 2684 wrote to memory of 2452 2684 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe reg.exe PID 2684 wrote to memory of 2452 2684 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe reg.exe PID 2684 wrote to memory of 2452 2684 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe reg.exe PID 2684 wrote to memory of 2736 2684 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe reg.exe PID 2684 wrote to memory of 2736 2684 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe reg.exe PID 2684 wrote to memory of 2736 2684 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe reg.exe PID 2684 wrote to memory of 2736 2684 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe reg.exe PID 2684 wrote to memory of 2288 2684 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe reg.exe PID 2684 wrote to memory of 2288 2684 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe reg.exe PID 2684 wrote to memory of 2288 2684 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe reg.exe PID 2684 wrote to memory of 2288 2684 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe reg.exe PID 2684 wrote to memory of 2292 2684 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe cmd.exe PID 2684 wrote to memory of 2292 2684 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe cmd.exe PID 2684 wrote to memory of 2292 2684 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe cmd.exe PID 2684 wrote to memory of 2292 2684 d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe cmd.exe PID 2292 wrote to memory of 2724 2292 cmd.exe cscript.exe PID 2292 wrote to memory of 2724 2292 cmd.exe cscript.exe PID 2292 wrote to memory of 2724 2292 cmd.exe cscript.exe PID 2292 wrote to memory of 2724 2292 cmd.exe cscript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AEkUcoos\ACsggEUw.exe"C:\Users\Admin\AEkUcoos\ACsggEUw.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:1580 -
C:\ProgramData\CcEAUUcc\taIkUUIc.exe"C:\ProgramData\CcEAUUcc\taIkUUIc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2040 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"2⤵
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"4⤵
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics5⤵
- Suspicious behavior: EnumeratesProcesses
PID:3016 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"6⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics7⤵
- Suspicious behavior: EnumeratesProcesses
PID:804 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"8⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics9⤵
- Suspicious behavior: EnumeratesProcesses
PID:480 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"10⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics11⤵
- Suspicious behavior: EnumeratesProcesses
PID:1064 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"12⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics13⤵
- Suspicious behavior: EnumeratesProcesses
PID:2848 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"14⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics15⤵
- Suspicious behavior: EnumeratesProcesses
PID:2712 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"16⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics17⤵
- Suspicious behavior: EnumeratesProcesses
PID:1808 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"18⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics19⤵
- Suspicious behavior: EnumeratesProcesses
PID:2992 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"20⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics21⤵
- Suspicious behavior: EnumeratesProcesses
PID:1256 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"22⤵PID:268
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics23⤵
- Suspicious behavior: EnumeratesProcesses
PID:784 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"24⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics25⤵
- Suspicious behavior: EnumeratesProcesses
PID:1508 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"26⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics27⤵
- Suspicious behavior: EnumeratesProcesses
PID:1800 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"28⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics29⤵
- Suspicious behavior: EnumeratesProcesses
PID:2772 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"30⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics31⤵
- Suspicious behavior: EnumeratesProcesses
PID:1236 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"32⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics33⤵
- Suspicious behavior: EnumeratesProcesses
PID:1748 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"34⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics35⤵
- Suspicious behavior: EnumeratesProcesses
PID:2308 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"36⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics37⤵
- Suspicious behavior: EnumeratesProcesses
PID:2224 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"38⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics39⤵
- Suspicious behavior: EnumeratesProcesses
PID:2412 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"40⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics41⤵
- Suspicious behavior: EnumeratesProcesses
PID:1648 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"42⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics43⤵
- Suspicious behavior: EnumeratesProcesses
PID:988 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"44⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics45⤵
- Suspicious behavior: EnumeratesProcesses
PID:1300 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"46⤵PID:664
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics47⤵
- Suspicious behavior: EnumeratesProcesses
PID:1572 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"48⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics49⤵
- Suspicious behavior: EnumeratesProcesses
PID:2616 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"50⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics51⤵
- Suspicious behavior: EnumeratesProcesses
PID:2824 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"52⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics53⤵
- Suspicious behavior: EnumeratesProcesses
PID:2748 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"54⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics55⤵
- Suspicious behavior: EnumeratesProcesses
PID:2736 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"56⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics57⤵
- Suspicious behavior: EnumeratesProcesses
PID:328 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"58⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics59⤵
- Suspicious behavior: EnumeratesProcesses
PID:2376 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"60⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics61⤵
- Suspicious behavior: EnumeratesProcesses
PID:2604 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"62⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics63⤵
- Suspicious behavior: EnumeratesProcesses
PID:2864 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"64⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics65⤵PID:2668
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"66⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics67⤵PID:1796
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"68⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics69⤵PID:1220
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"70⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics71⤵PID:1536
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"72⤵PID:664
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics73⤵PID:772
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"74⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics75⤵PID:2024
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"76⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics77⤵PID:2724
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"78⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics79⤵PID:2016
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"80⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics81⤵PID:2192
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"82⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics83⤵PID:1696
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"84⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics85⤵PID:1500
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"86⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics87⤵PID:1768
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"88⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics89⤵PID:2588
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"90⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics91⤵PID:864
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"92⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics93⤵PID:2736
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"94⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics95⤵PID:2792
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"96⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics97⤵PID:1912
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"98⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics99⤵PID:2416
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"100⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics101⤵PID:1368
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"102⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics103⤵PID:1676
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"104⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics105⤵PID:1976
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"106⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics107⤵PID:804
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"108⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics109⤵PID:960
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"110⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics111⤵PID:700
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"112⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics113⤵PID:1620
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"114⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics115⤵PID:1932
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"116⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics117⤵PID:2764
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"118⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics119⤵PID:1568
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"120⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics121⤵PID:1116
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"122⤵PID:664
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics123⤵PID:1612
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"124⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics125⤵PID:1976
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"126⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics127⤵PID:2564
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"128⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics129⤵PID:2356
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"130⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics131⤵PID:1800
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"132⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics133⤵PID:2192
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"134⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics135⤵PID:1744
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"136⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics137⤵PID:2856
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"138⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics139⤵PID:2996
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"140⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics141⤵PID:2572
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"142⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics143⤵PID:2580
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"144⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics145⤵PID:1792
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"146⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics147⤵PID:2588
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"148⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics149⤵PID:3032
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"150⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics151⤵PID:1976
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"152⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics153⤵PID:3020
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"154⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics155⤵PID:1464
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"156⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics157⤵PID:1728
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"158⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics159⤵PID:3068
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"160⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics161⤵PID:2668
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"162⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics163⤵PID:2192
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"164⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics165⤵PID:1176
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"166⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics167⤵PID:1488
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"168⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics169⤵PID:2280
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"170⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics171⤵PID:932
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"172⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics173⤵PID:2748
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"174⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics175⤵PID:2640
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"176⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics177⤵PID:2484
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"178⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics179⤵PID:2848
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"180⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics181⤵PID:1000
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"182⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics183⤵PID:348
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"184⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics185⤵PID:1132
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"186⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics187⤵PID:2420
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"188⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics189⤵PID:1744
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"190⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics191⤵PID:3064
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"192⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics193⤵PID:1584
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"194⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics195⤵PID:1480
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"196⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics197⤵PID:2552
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"198⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics199⤵PID:2504
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"200⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics201⤵
- Adds Run key to start application
PID:2500 -
C:\Users\Admin\JAIcUMUw\sqUoMkUo.exe"C:\Users\Admin\JAIcUMUw\sqUoMkUo.exe"202⤵PID:2344
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 36203⤵
- Program crash
PID:2372 -
C:\ProgramData\Ucscscog\SAQEEEAo.exe"C:\ProgramData\Ucscscog\SAQEEEAo.exe"202⤵PID:2848
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2848 -s 36203⤵
- Program crash
PID:1076 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"202⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics203⤵PID:1116
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"204⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics205⤵PID:1416
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"206⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics207⤵PID:2632
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"208⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics209⤵PID:2168
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"210⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics211⤵PID:2024
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"212⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics213⤵PID:356
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"214⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics215⤵PID:2088
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"216⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics217⤵PID:1488
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"218⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics219⤵PID:3060
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"220⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics221⤵PID:2060
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"222⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics223⤵PID:2388
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"224⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics225⤵PID:1636
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"226⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics227⤵PID:2572
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"228⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics229⤵PID:2888
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"230⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics231⤵PID:2940
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"232⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics233⤵PID:2640
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"234⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics235⤵PID:1736
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"236⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics237⤵PID:2388
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"238⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics239⤵PID:1636
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics"240⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\d165263328a22c1a3e486b0b6d01c830_NeikiAnalytics241⤵PID:284
-