Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 23:50
Static task
static1
Behavioral task
behavioral1
Sample
38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe
-
Size
200KB
-
MD5
38f268c9bcf9ea423536692a5155e550
-
SHA1
84e642a22e4e3193b0b5199ad0e54d7fa91e9057
-
SHA256
ef463971ba1d1e13a91563590311c4c546f850d4f9543d16aac3572bf02b5920
-
SHA512
755b4a7064d707728a6ed9b6780e65f0163dd52f7bae32e7a5c8b8a78e440b379142a702d543b0f87c8cae950115b19341f6d8bab878d91ae1863316fc55fb7d
-
SSDEEP
6144:oj9pnEKyOHVDSHUQzuDVFTDSrXT1F/vgdv5jueq:oj9pELKVDSHUQOFk1FQd9h
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (57) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
pgYsgEsI.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\International\Geo\Nation pgYsgEsI.exe -
Executes dropped EXE 2 IoCs
Processes:
pgYsgEsI.exeGMcUgMUs.exepid process 2084 pgYsgEsI.exe 2564 GMcUgMUs.exe -
Loads dropped DLL 20 IoCs
Processes:
38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exepgYsgEsI.exepid process 2232 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 2232 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 2232 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 2232 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exepgYsgEsI.exeGMcUgMUs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\pgYsgEsI.exe = "C:\\Users\\Admin\\DgMkIgEk\\pgYsgEsI.exe" 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\GMcUgMUs.exe = "C:\\ProgramData\\loQosQIg\\GMcUgMUs.exe" 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\pgYsgEsI.exe = "C:\\Users\\Admin\\DgMkIgEk\\pgYsgEsI.exe" pgYsgEsI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\GMcUgMUs.exe = "C:\\ProgramData\\loQosQIg\\GMcUgMUs.exe" GMcUgMUs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 1776 reg.exe 1964 reg.exe 296 reg.exe 1548 reg.exe 2316 reg.exe 2480 reg.exe 2296 reg.exe 1112 reg.exe 2388 reg.exe 2616 reg.exe 1992 reg.exe 2376 reg.exe 2800 reg.exe 2292 reg.exe 2244 reg.exe 1908 reg.exe 2352 reg.exe 840 reg.exe 2324 reg.exe 2712 reg.exe 1780 reg.exe 2524 reg.exe 1076 reg.exe 2944 reg.exe 1104 reg.exe 2152 reg.exe 2008 reg.exe 2652 reg.exe 2264 reg.exe 2748 reg.exe 1168 reg.exe 2824 reg.exe 2692 reg.exe 2792 reg.exe 560 reg.exe 2920 reg.exe 664 reg.exe 2832 reg.exe 1140 reg.exe 1092 reg.exe 1480 reg.exe 1844 reg.exe 964 reg.exe 1408 reg.exe 2408 reg.exe 2356 reg.exe 1648 reg.exe 1112 reg.exe 2460 reg.exe 2500 reg.exe 1928 reg.exe 1392 reg.exe 1764 reg.exe 1020 reg.exe 2728 reg.exe 2684 reg.exe 2296 reg.exe 2556 reg.exe 1836 reg.exe 1132 reg.exe 2744 reg.exe 1112 reg.exe 2960 reg.exe 448 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exepid process 2232 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 2232 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 2604 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 2604 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 1592 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 1592 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 1532 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 1532 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 1508 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 1508 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 984 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 984 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 2032 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 2032 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 2232 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 2232 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 2480 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 2480 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 1424 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 1424 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 1740 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 1740 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 1180 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 1180 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 2260 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 2260 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 2008 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 2008 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 1124 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 1124 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 2952 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 2952 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 1736 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 1736 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 2972 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 2972 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 2344 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 2344 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 2548 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 2548 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 2008 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 2008 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 1008 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 1008 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 412 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 412 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 1828 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 1828 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 1064 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 1064 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 1996 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 1996 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 1692 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 1692 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 2628 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 2628 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 2288 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 2288 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 1168 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 1168 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 912 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 912 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 2744 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe 2744 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pgYsgEsI.exepid process 2084 pgYsgEsI.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
pgYsgEsI.exepid process 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe 2084 pgYsgEsI.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.execmd.execmd.exe38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.execmd.execmd.exedescription pid process target process PID 2232 wrote to memory of 2084 2232 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe pgYsgEsI.exe PID 2232 wrote to memory of 2084 2232 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe pgYsgEsI.exe PID 2232 wrote to memory of 2084 2232 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe pgYsgEsI.exe PID 2232 wrote to memory of 2084 2232 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe pgYsgEsI.exe PID 2232 wrote to memory of 2564 2232 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe GMcUgMUs.exe PID 2232 wrote to memory of 2564 2232 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe GMcUgMUs.exe PID 2232 wrote to memory of 2564 2232 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe GMcUgMUs.exe PID 2232 wrote to memory of 2564 2232 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe GMcUgMUs.exe PID 2232 wrote to memory of 2724 2232 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe cmd.exe PID 2232 wrote to memory of 2724 2232 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe cmd.exe PID 2232 wrote to memory of 2724 2232 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe cmd.exe PID 2232 wrote to memory of 2724 2232 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe cmd.exe PID 2724 wrote to memory of 2604 2724 cmd.exe 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe PID 2724 wrote to memory of 2604 2724 cmd.exe 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe PID 2724 wrote to memory of 2604 2724 cmd.exe 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe PID 2724 wrote to memory of 2604 2724 cmd.exe 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe PID 2232 wrote to memory of 2596 2232 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe reg.exe PID 2232 wrote to memory of 2596 2232 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe reg.exe PID 2232 wrote to memory of 2596 2232 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe reg.exe PID 2232 wrote to memory of 2596 2232 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe reg.exe PID 2232 wrote to memory of 2760 2232 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe reg.exe PID 2232 wrote to memory of 2760 2232 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe reg.exe PID 2232 wrote to memory of 2760 2232 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe reg.exe PID 2232 wrote to memory of 2760 2232 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe reg.exe PID 2232 wrote to memory of 2740 2232 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe reg.exe PID 2232 wrote to memory of 2740 2232 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe reg.exe PID 2232 wrote to memory of 2740 2232 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe reg.exe PID 2232 wrote to memory of 2740 2232 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe reg.exe PID 2232 wrote to memory of 2496 2232 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe cmd.exe PID 2232 wrote to memory of 2496 2232 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe cmd.exe PID 2232 wrote to memory of 2496 2232 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe cmd.exe PID 2232 wrote to memory of 2496 2232 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe cmd.exe PID 2496 wrote to memory of 2592 2496 cmd.exe cscript.exe PID 2496 wrote to memory of 2592 2496 cmd.exe cscript.exe PID 2496 wrote to memory of 2592 2496 cmd.exe cscript.exe PID 2496 wrote to memory of 2592 2496 cmd.exe cscript.exe PID 2604 wrote to memory of 952 2604 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe cmd.exe PID 2604 wrote to memory of 952 2604 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe cmd.exe PID 2604 wrote to memory of 952 2604 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe cmd.exe PID 2604 wrote to memory of 952 2604 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe cmd.exe PID 952 wrote to memory of 1592 952 cmd.exe 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe PID 952 wrote to memory of 1592 952 cmd.exe 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe PID 952 wrote to memory of 1592 952 cmd.exe 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe PID 952 wrote to memory of 1592 952 cmd.exe 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe PID 2604 wrote to memory of 1944 2604 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe reg.exe PID 2604 wrote to memory of 1944 2604 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe reg.exe PID 2604 wrote to memory of 1944 2604 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe reg.exe PID 2604 wrote to memory of 1944 2604 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe reg.exe PID 2604 wrote to memory of 1900 2604 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe reg.exe PID 2604 wrote to memory of 1900 2604 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe reg.exe PID 2604 wrote to memory of 1900 2604 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe reg.exe PID 2604 wrote to memory of 1900 2604 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe reg.exe PID 2604 wrote to memory of 1904 2604 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe reg.exe PID 2604 wrote to memory of 1904 2604 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe reg.exe PID 2604 wrote to memory of 1904 2604 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe reg.exe PID 2604 wrote to memory of 1904 2604 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe reg.exe PID 2604 wrote to memory of 2532 2604 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe cmd.exe PID 2604 wrote to memory of 2532 2604 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe cmd.exe PID 2604 wrote to memory of 2532 2604 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe cmd.exe PID 2604 wrote to memory of 2532 2604 38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe cmd.exe PID 2532 wrote to memory of 2792 2532 cmd.exe cscript.exe PID 2532 wrote to memory of 2792 2532 cmd.exe cscript.exe PID 2532 wrote to memory of 2792 2532 cmd.exe cscript.exe PID 2532 wrote to memory of 2792 2532 cmd.exe cscript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\DgMkIgEk\pgYsgEsI.exe"C:\Users\Admin\DgMkIgEk\pgYsgEsI.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\loQosQIg\GMcUgMUs.exe"C:\ProgramData\loQosQIg\GMcUgMUs.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"6⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"8⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"10⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"12⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"14⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"16⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"18⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"20⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"22⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"24⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"26⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"28⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"30⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"32⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"34⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics35⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"36⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics37⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"38⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics39⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"40⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics41⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"42⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics43⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"44⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics45⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"46⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics47⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"48⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics49⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"50⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics51⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"52⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics53⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"54⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics55⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"56⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics57⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"58⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics59⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"60⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics61⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"62⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics63⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"64⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics65⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"66⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics67⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"68⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics69⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"70⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics71⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"72⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics73⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"74⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics75⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"76⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics77⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"78⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics79⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"80⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics81⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"82⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics83⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"84⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics85⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"86⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics87⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"88⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics89⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"90⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics91⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"92⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics93⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"94⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics95⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"96⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics97⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"98⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics99⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"100⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics101⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"102⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics103⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"104⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics105⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"106⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics107⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"108⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics109⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"110⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics111⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"112⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics113⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"114⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics115⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"116⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics117⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"118⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics119⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"120⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics121⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"122⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics123⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"124⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics125⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"126⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics127⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"128⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics129⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"130⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics131⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"132⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics133⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"134⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics135⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"136⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics137⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"138⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics139⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"140⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics141⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"142⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics143⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"144⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics145⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"146⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics147⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"148⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics149⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"150⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics151⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"152⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics153⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"154⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics155⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"156⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics157⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"158⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics159⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"160⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics161⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"162⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics163⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"164⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics165⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"166⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics167⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"168⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics169⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"170⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics171⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"172⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics173⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"174⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics175⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"176⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics177⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"178⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics179⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"180⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics181⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"182⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics183⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"184⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics185⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"186⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics187⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"188⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics189⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"190⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics191⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"192⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics193⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"194⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics195⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"196⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics197⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"198⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics199⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"200⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics201⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"202⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics203⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"204⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics205⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"206⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics207⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"208⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics209⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"210⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics211⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"212⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics213⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"214⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics215⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"216⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics217⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"218⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics219⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"220⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics221⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"222⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics223⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"224⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics225⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"226⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics227⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"228⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics229⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"230⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics231⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"232⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics233⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"234⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics235⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"236⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics237⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"238⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics239⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics"240⤵
-
C:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\38f268c9bcf9ea423536692a5155e550_NeikiAnalytics241⤵