Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 02:59
Static task
static1
Behavioral task
behavioral1
Sample
9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe
-
Size
204KB
-
MD5
9b1d72ad3e9aea2742d3f952f7649ee0
-
SHA1
ae9a682bd00d3cc4f20e48e21e9372b458d139bd
-
SHA256
afcb02001cc9bb7e6ce8de22255503646f108594bc8dc5f5e7be00864f97c0af
-
SHA512
300824b7b1cc3bec42e93b10f9decd6da2b35b1dedff092b100e214869e33c2532a301a1a61f4c008bbc3344ec18e15b13d42b7e5017b8b8a3bb4318e8a1395c
-
SSDEEP
3072:38ZBkYna9EGOeO4OZcHbLleqeASKTkgvt5rUlIipnljzNgV6:yBkYa9r64ccDpXrmIiplvN
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (57) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
lsgcsIIs.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\International\Geo\Nation lsgcsIIs.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1464 cmd.exe -
Executes dropped EXE 2 IoCs
Processes:
lsgcsIIs.exevIUYMUAI.exepid process 2004 lsgcsIIs.exe 2992 vIUYMUAI.exe -
Loads dropped DLL 20 IoCs
Processes:
9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exelsgcsIIs.exepid process 2116 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 2116 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 2116 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 2116 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exelsgcsIIs.exevIUYMUAI.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsgcsIIs.exe = "C:\\Users\\Admin\\XysYQokI\\lsgcsIIs.exe" 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vIUYMUAI.exe = "C:\\ProgramData\\PkAwEgUo\\vIUYMUAI.exe" 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsgcsIIs.exe = "C:\\Users\\Admin\\XysYQokI\\lsgcsIIs.exe" lsgcsIIs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vIUYMUAI.exe = "C:\\ProgramData\\PkAwEgUo\\vIUYMUAI.exe" vIUYMUAI.exe -
Drops file in Windows directory 1 IoCs
Processes:
lsgcsIIs.exedescription ioc process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico lsgcsIIs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 3016 reg.exe 904 reg.exe 2504 reg.exe 1992 reg.exe 708 reg.exe 2400 reg.exe 1756 reg.exe 2524 reg.exe 2432 reg.exe 2736 reg.exe 2892 reg.exe 1328 reg.exe 2768 reg.exe 828 reg.exe 1664 reg.exe 1036 reg.exe 2588 reg.exe 1168 reg.exe 1728 reg.exe 2292 reg.exe 1044 reg.exe 2676 reg.exe 1416 reg.exe 2804 reg.exe 1372 reg.exe 1616 reg.exe 2340 reg.exe 1756 reg.exe 2960 reg.exe 624 reg.exe 2832 reg.exe 1724 reg.exe 2688 reg.exe 2976 reg.exe 1712 reg.exe 2560 reg.exe 3004 reg.exe 2472 reg.exe 2656 reg.exe 1728 reg.exe 1036 reg.exe 2692 reg.exe 716 reg.exe 868 reg.exe 1936 reg.exe 1824 reg.exe 2564 reg.exe 1524 reg.exe 780 reg.exe 556 reg.exe 2456 reg.exe 1700 reg.exe 1832 reg.exe 1676 reg.exe 2908 reg.exe 2700 reg.exe 2800 reg.exe 2468 reg.exe 1552 reg.exe 2840 reg.exe 1180 reg.exe 2528 reg.exe 1988 reg.exe 2820 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exepid process 2116 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 2116 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 2624 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 2624 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 2860 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 2860 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 536 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 536 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 2016 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 2016 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 1608 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 1608 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 1800 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 1800 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 2116 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 2116 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 2840 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 2840 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 1636 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 1636 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 3032 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 3032 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 2016 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 2016 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 2236 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 2236 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 2564 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 2564 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 2668 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 2668 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 2672 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 2672 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 2328 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 2328 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 1616 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 1616 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 1712 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 1712 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 2396 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 2396 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 1260 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 1260 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 2864 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 2864 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 2672 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 2672 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 2920 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 2920 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 3064 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 3064 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 1968 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 1968 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 2008 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 2008 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 2504 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 2504 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 1284 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 1284 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 2468 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 2468 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 2852 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 2852 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 2192 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe 2192 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
lsgcsIIs.exepid process 2004 lsgcsIIs.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
lsgcsIIs.exepid process 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe 2004 lsgcsIIs.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.execmd.execmd.exe9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.execmd.execmd.exedescription pid process target process PID 2116 wrote to memory of 2004 2116 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe lsgcsIIs.exe PID 2116 wrote to memory of 2004 2116 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe lsgcsIIs.exe PID 2116 wrote to memory of 2004 2116 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe lsgcsIIs.exe PID 2116 wrote to memory of 2004 2116 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe lsgcsIIs.exe PID 2116 wrote to memory of 2992 2116 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe vIUYMUAI.exe PID 2116 wrote to memory of 2992 2116 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe vIUYMUAI.exe PID 2116 wrote to memory of 2992 2116 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe vIUYMUAI.exe PID 2116 wrote to memory of 2992 2116 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe vIUYMUAI.exe PID 2116 wrote to memory of 2840 2116 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe cmd.exe PID 2116 wrote to memory of 2840 2116 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe cmd.exe PID 2116 wrote to memory of 2840 2116 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe cmd.exe PID 2116 wrote to memory of 2840 2116 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe cmd.exe PID 2840 wrote to memory of 2624 2840 cmd.exe 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe PID 2840 wrote to memory of 2624 2840 cmd.exe 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe PID 2840 wrote to memory of 2624 2840 cmd.exe 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe PID 2840 wrote to memory of 2624 2840 cmd.exe 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe PID 2116 wrote to memory of 2784 2116 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe reg.exe PID 2116 wrote to memory of 2784 2116 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe reg.exe PID 2116 wrote to memory of 2784 2116 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe reg.exe PID 2116 wrote to memory of 2784 2116 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe reg.exe PID 2116 wrote to memory of 3048 2116 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe reg.exe PID 2116 wrote to memory of 3048 2116 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe reg.exe PID 2116 wrote to memory of 3048 2116 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe reg.exe PID 2116 wrote to memory of 3048 2116 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe reg.exe PID 2116 wrote to memory of 2900 2116 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe reg.exe PID 2116 wrote to memory of 2900 2116 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe reg.exe PID 2116 wrote to memory of 2900 2116 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe reg.exe PID 2116 wrote to memory of 2900 2116 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe reg.exe PID 2116 wrote to memory of 2544 2116 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe cmd.exe PID 2116 wrote to memory of 2544 2116 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe cmd.exe PID 2116 wrote to memory of 2544 2116 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe cmd.exe PID 2116 wrote to memory of 2544 2116 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe cmd.exe PID 2544 wrote to memory of 2396 2544 cmd.exe cscript.exe PID 2544 wrote to memory of 2396 2544 cmd.exe cscript.exe PID 2544 wrote to memory of 2396 2544 cmd.exe cscript.exe PID 2544 wrote to memory of 2396 2544 cmd.exe cscript.exe PID 2624 wrote to memory of 2736 2624 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe cmd.exe PID 2624 wrote to memory of 2736 2624 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe cmd.exe PID 2624 wrote to memory of 2736 2624 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe cmd.exe PID 2624 wrote to memory of 2736 2624 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe cmd.exe PID 2736 wrote to memory of 2860 2736 cmd.exe 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe PID 2736 wrote to memory of 2860 2736 cmd.exe 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe PID 2736 wrote to memory of 2860 2736 cmd.exe 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe PID 2736 wrote to memory of 2860 2736 cmd.exe 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe PID 2624 wrote to memory of 2828 2624 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe reg.exe PID 2624 wrote to memory of 2828 2624 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe reg.exe PID 2624 wrote to memory of 2828 2624 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe reg.exe PID 2624 wrote to memory of 2828 2624 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe reg.exe PID 2624 wrote to memory of 2960 2624 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe reg.exe PID 2624 wrote to memory of 2960 2624 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe reg.exe PID 2624 wrote to memory of 2960 2624 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe reg.exe PID 2624 wrote to memory of 2960 2624 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe reg.exe PID 2624 wrote to memory of 2204 2624 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe reg.exe PID 2624 wrote to memory of 2204 2624 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe reg.exe PID 2624 wrote to memory of 2204 2624 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe reg.exe PID 2624 wrote to memory of 2204 2624 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe reg.exe PID 2624 wrote to memory of 552 2624 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe cmd.exe PID 2624 wrote to memory of 552 2624 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe cmd.exe PID 2624 wrote to memory of 552 2624 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe cmd.exe PID 2624 wrote to memory of 552 2624 9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe cmd.exe PID 552 wrote to memory of 1772 552 cmd.exe cscript.exe PID 552 wrote to memory of 1772 552 cmd.exe cscript.exe PID 552 wrote to memory of 1772 552 cmd.exe cscript.exe PID 552 wrote to memory of 1772 552 cmd.exe cscript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\XysYQokI\lsgcsIIs.exe"C:\Users\Admin\XysYQokI\lsgcsIIs.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\PkAwEgUo\vIUYMUAI.exe"C:\ProgramData\PkAwEgUo\vIUYMUAI.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"6⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"8⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"10⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"12⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"14⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"16⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"18⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"20⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"22⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"24⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"26⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"28⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"30⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"32⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"34⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics35⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"36⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics37⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"38⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics39⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"40⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics41⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"42⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics43⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"44⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics45⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"46⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics47⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"48⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics49⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"50⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics51⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"52⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics53⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"54⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics55⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"56⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics57⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"58⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics59⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"60⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics61⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"62⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics63⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"64⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics65⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"66⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics67⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"68⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics69⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"70⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics71⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"72⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics73⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"74⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics75⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"76⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics77⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"78⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics79⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"80⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics81⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"82⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics83⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"84⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics85⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"86⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics87⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"88⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics89⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"90⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics91⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"92⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics93⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"94⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics95⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"96⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics97⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"98⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics99⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"100⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics101⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"102⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics103⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"104⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics105⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"106⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics107⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"108⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics109⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"110⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics111⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"112⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics113⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"114⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics115⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"116⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics117⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"118⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics119⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"120⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics121⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"122⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics123⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"124⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics125⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"126⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics127⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"128⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics129⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"130⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics131⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"132⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics133⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"134⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics135⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"136⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics137⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"138⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics139⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"140⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics141⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"142⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics143⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"144⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics145⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"146⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics147⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"148⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics149⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"150⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics151⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"152⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics153⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"154⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics155⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"156⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics157⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"158⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics159⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"160⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics161⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"162⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics163⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"164⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics165⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"166⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics167⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"168⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics169⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"170⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics171⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"172⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics173⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"174⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics175⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"176⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics177⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"178⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics179⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"180⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics181⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"182⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics183⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"184⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics185⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"186⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics187⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"188⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics189⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"190⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics191⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"192⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics193⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"194⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics195⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"196⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics197⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"198⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics199⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"200⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics201⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"202⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics203⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"204⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics205⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"206⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics207⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"208⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics209⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"210⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics211⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"212⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics213⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"214⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics215⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"216⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics217⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"218⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics219⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"220⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics221⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"222⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics223⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"224⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics225⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"226⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics227⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"228⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics229⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"230⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics231⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"232⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics233⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"234⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics235⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"236⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics237⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"238⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics239⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics"240⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1240⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2240⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f240⤵
- UAC bypass
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\aawMoUcg.bat" "C:\Users\Admin\AppData\Local\Temp\9b1d72ad3e9aea2742d3f952f7649ee0_NeikiAnalytics.exe""240⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs241⤵