Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 19:32
Static task
static1
Behavioral task
behavioral1
Sample
2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe
-
Size
198KB
-
MD5
2f8b2e08cd10884f0607604c4ece2f20
-
SHA1
423eeee56bd4e1da9878e66449a9280f1cfa2bda
-
SHA256
305ec95c469f250ddf3213b4804ea4e384e17928a4cd99e486c18769129b24de
-
SHA512
9cbd1b74ad89f22d81fcea2da016405fc853135b7001bf2bc45ddf5ef0f4338d1562c96e35c2c4b281b7ab7e554b01faa4e7a1fbb82603616d8e427fd41f8641
-
SSDEEP
3072:Nheh6phA+a22yDR98H2N2Ov7sCH37vbX0MU8s/9CNIKpNGhP28e:N4h44Ct2OT7X7DY8sFKpAhu8e
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (78) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
TiIksEkg.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation TiIksEkg.exe -
Executes dropped EXE 2 IoCs
Processes:
TiIksEkg.exeIKEQAoMo.exepid process 3652 TiIksEkg.exe 2952 IKEQAoMo.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeTiIksEkg.exeIKEQAoMo.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IKEQAoMo.exe = "C:\\ProgramData\\pkUYgosA\\IKEQAoMo.exe" 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TiIksEkg.exe = "C:\\Users\\Admin\\mQUUAUgI\\TiIksEkg.exe" TiIksEkg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IKEQAoMo.exe = "C:\\ProgramData\\pkUYgosA\\IKEQAoMo.exe" IKEQAoMo.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TiIksEkg.exe = "C:\\Users\\Admin\\mQUUAUgI\\TiIksEkg.exe" 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe -
Drops file in System32 directory 2 IoCs
Processes:
TiIksEkg.exedescription ioc process File created C:\Windows\SysWOW64\shell32.dll.exe TiIksEkg.exe File opened for modification C:\Windows\SysWOW64\shell32.dll.exe TiIksEkg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 4816 reg.exe 2608 3468 reg.exe 2892 reg.exe 1756 reg.exe 4876 reg.exe 2552 reg.exe 1092 reg.exe 1700 reg.exe 772 reg.exe 3020 reg.exe 4436 reg.exe 4848 reg.exe 2388 reg.exe 4340 reg.exe 872 reg.exe 4324 reg.exe 412 reg.exe 1904 reg.exe 4680 reg.exe 5036 reg.exe 2512 5032 reg.exe 2492 reg.exe 1444 reg.exe 2556 reg.exe 1780 1016 reg.exe 3796 reg.exe 4956 reg.exe 3948 reg.exe 2840 reg.exe 1148 reg.exe 3480 reg.exe 4872 reg.exe 1716 reg.exe 1840 reg.exe 400 reg.exe 436 reg.exe 1596 reg.exe 1176 reg.exe 4328 reg.exe 3696 2476 reg.exe 3216 reg.exe 3664 reg.exe 2804 reg.exe 2528 reg.exe 1368 reg.exe 2428 reg.exe 4244 reg.exe 1452 reg.exe 736 reg.exe 3512 reg.exe 912 reg.exe 4604 reg.exe 4024 reg.exe 1156 reg.exe 4408 reg.exe 3556 reg.exe 400 reg.exe 3596 reg.exe 4484 reg.exe 4608 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exepid process 860 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 860 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 860 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 860 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 920 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 920 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 920 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 920 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 5072 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 5072 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 5072 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 5072 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 3296 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 3296 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 3296 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 3296 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 4436 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 4436 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 4436 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 4436 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 4240 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 4240 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 4240 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 4240 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 3896 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 3896 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 3896 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 3896 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 1516 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 1516 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 1516 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 1516 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 4908 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 4908 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 4908 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 4908 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 4868 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 4868 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 4868 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 4868 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 4888 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 4888 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 4888 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 4888 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 3016 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 3016 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 3016 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 3016 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 1516 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 1516 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 1516 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 1516 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 3308 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 3308 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 3308 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 3308 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 4240 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 4240 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 4240 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 4240 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 3572 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 3572 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 3572 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe 3572 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
TiIksEkg.exepid process 3652 TiIksEkg.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
TiIksEkg.exepid process 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe 3652 TiIksEkg.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.execmd.execmd.exe2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.execmd.execmd.exe2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.execmd.exedescription pid process target process PID 860 wrote to memory of 3652 860 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe TiIksEkg.exe PID 860 wrote to memory of 3652 860 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe TiIksEkg.exe PID 860 wrote to memory of 3652 860 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe TiIksEkg.exe PID 860 wrote to memory of 2952 860 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe IKEQAoMo.exe PID 860 wrote to memory of 2952 860 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe IKEQAoMo.exe PID 860 wrote to memory of 2952 860 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe IKEQAoMo.exe PID 860 wrote to memory of 4468 860 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe cmd.exe PID 860 wrote to memory of 4468 860 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe cmd.exe PID 860 wrote to memory of 4468 860 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe cmd.exe PID 4468 wrote to memory of 920 4468 cmd.exe 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe PID 4468 wrote to memory of 920 4468 cmd.exe 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe PID 4468 wrote to memory of 920 4468 cmd.exe 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe PID 860 wrote to memory of 804 860 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe reg.exe PID 860 wrote to memory of 804 860 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe reg.exe PID 860 wrote to memory of 804 860 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe reg.exe PID 860 wrote to memory of 1924 860 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe reg.exe PID 860 wrote to memory of 1924 860 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe reg.exe PID 860 wrote to memory of 1924 860 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe reg.exe PID 860 wrote to memory of 404 860 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe reg.exe PID 860 wrote to memory of 404 860 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe reg.exe PID 860 wrote to memory of 404 860 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe reg.exe PID 860 wrote to memory of 2512 860 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe cmd.exe PID 860 wrote to memory of 2512 860 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe cmd.exe PID 860 wrote to memory of 2512 860 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe cmd.exe PID 2512 wrote to memory of 4880 2512 cmd.exe cscript.exe PID 2512 wrote to memory of 4880 2512 cmd.exe cscript.exe PID 2512 wrote to memory of 4880 2512 cmd.exe cscript.exe PID 920 wrote to memory of 464 920 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe cmd.exe PID 920 wrote to memory of 464 920 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe cmd.exe PID 920 wrote to memory of 464 920 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe cmd.exe PID 464 wrote to memory of 5072 464 cmd.exe 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe PID 464 wrote to memory of 5072 464 cmd.exe 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe PID 464 wrote to memory of 5072 464 cmd.exe 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe PID 920 wrote to memory of 5084 920 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe reg.exe PID 920 wrote to memory of 5084 920 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe reg.exe PID 920 wrote to memory of 5084 920 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe reg.exe PID 920 wrote to memory of 3600 920 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe reg.exe PID 920 wrote to memory of 3600 920 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe reg.exe PID 920 wrote to memory of 3600 920 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe reg.exe PID 920 wrote to memory of 2364 920 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe reg.exe PID 920 wrote to memory of 2364 920 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe reg.exe PID 920 wrote to memory of 2364 920 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe reg.exe PID 920 wrote to memory of 5104 920 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe cmd.exe PID 920 wrote to memory of 5104 920 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe cmd.exe PID 920 wrote to memory of 5104 920 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe cmd.exe PID 5104 wrote to memory of 3976 5104 cmd.exe cscript.exe PID 5104 wrote to memory of 3976 5104 cmd.exe cscript.exe PID 5104 wrote to memory of 3976 5104 cmd.exe cscript.exe PID 5072 wrote to memory of 2264 5072 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe cmd.exe PID 5072 wrote to memory of 2264 5072 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe cmd.exe PID 5072 wrote to memory of 2264 5072 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe cmd.exe PID 2264 wrote to memory of 3296 2264 cmd.exe 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe PID 2264 wrote to memory of 3296 2264 cmd.exe 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe PID 2264 wrote to memory of 3296 2264 cmd.exe 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe PID 5072 wrote to memory of 2428 5072 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe reg.exe PID 5072 wrote to memory of 2428 5072 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe reg.exe PID 5072 wrote to memory of 2428 5072 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe reg.exe PID 5072 wrote to memory of 3340 5072 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe reg.exe PID 5072 wrote to memory of 3340 5072 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe reg.exe PID 5072 wrote to memory of 3340 5072 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe reg.exe PID 5072 wrote to memory of 4024 5072 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe reg.exe PID 5072 wrote to memory of 4024 5072 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe reg.exe PID 5072 wrote to memory of 4024 5072 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe reg.exe PID 5072 wrote to memory of 4276 5072 2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\mQUUAUgI\TiIksEkg.exe"C:\Users\Admin\mQUUAUgI\TiIksEkg.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\pkUYgosA\IKEQAoMo.exe"C:\ProgramData\pkUYgosA\IKEQAoMo.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"8⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"10⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"12⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"14⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"16⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"18⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"22⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"24⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"26⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"28⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"30⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"34⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"36⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"40⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"42⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"44⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"46⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"48⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"50⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"52⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"54⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"56⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"58⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"60⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"62⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"64⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV165⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"66⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"68⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"70⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics71⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"72⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics73⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"74⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"76⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics77⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"78⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics79⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"80⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics81⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"82⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics83⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"84⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics85⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"86⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics87⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"88⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics89⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"90⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"92⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics93⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"94⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics95⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"96⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV197⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics97⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"98⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV199⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics99⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"100⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics101⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"102⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics103⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"104⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1105⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics105⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"106⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics107⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"108⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1109⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics109⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"110⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics111⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"112⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics113⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"114⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics115⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"116⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics117⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"118⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics119⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"120⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics121⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"122⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics123⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"124⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics125⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"126⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics127⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"128⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics129⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"130⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics131⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"132⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics133⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"134⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics135⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"136⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics137⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"138⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics139⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"140⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics141⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"142⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics143⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"144⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics145⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"146⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics147⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"148⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics149⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"150⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics151⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"152⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics153⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"154⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics155⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"156⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics157⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"158⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics159⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"160⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics161⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"162⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics163⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"164⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1165⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics165⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"166⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics167⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"168⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics169⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"170⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics171⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"172⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics173⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"174⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics175⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"176⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics177⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"178⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics179⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"180⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics181⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"182⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics183⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"184⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics185⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"186⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics187⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"188⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics189⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"190⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics191⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"192⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics193⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"194⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics195⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"196⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics197⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"198⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics199⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"200⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics201⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"202⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics203⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"204⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics205⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"206⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics207⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"208⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1209⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics209⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"210⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics211⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"212⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics213⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"214⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics215⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"216⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics217⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"218⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics219⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"220⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics221⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"222⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics223⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"224⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics225⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"226⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics227⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"228⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics229⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"230⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics231⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"232⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics233⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"234⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics235⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"236⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics237⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"238⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics239⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics"240⤵
-
C:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2f8b2e08cd10884f0607604c4ece2f20_NeikiAnalytics241⤵