Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 08:28
Static task
static1
Behavioral task
behavioral1
Sample
f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe
-
Size
202KB
-
MD5
f7161f431e5ffd38b200f70b967f01c0
-
SHA1
34e875f7682d942696525e20470f6f586d6cd4f8
-
SHA256
dc921bbe8fd76aead5cd7f1e1e83182af90b59ab2a463ebcbfa73baa428c38b1
-
SHA512
7c004cf06f7ab6d249f57fa47049ed242693e74e5dac37ea0c3fc4f782976d1bccb90476c13b14bdcc288711714eef4166a912fb88b63de97675e3686f3f88cf
-
SSDEEP
3072:yCXKPODMyOLH4x93AiDS3zzvMHuxfq0276HoWlrC912rZZH/8UIQT2t35yB:mmn13f5WoPsZBfEt35y
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (55) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
XCEcgoIY.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Control Panel\International\Geo\Nation XCEcgoIY.exe -
Executes dropped EXE 2 IoCs
Processes:
XCEcgoIY.exeayscUUEE.exepid process 1312 XCEcgoIY.exe 2208 ayscUUEE.exe -
Loads dropped DLL 20 IoCs
Processes:
f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeXCEcgoIY.exepid process 2356 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2356 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2356 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2356 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeXCEcgoIY.exeayscUUEE.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ayscUUEE.exe = "C:\\ProgramData\\BKUgUgcg\\ayscUUEE.exe" f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\XCEcgoIY.exe = "C:\\Users\\Admin\\nYwkcUws\\XCEcgoIY.exe" XCEcgoIY.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ayscUUEE.exe = "C:\\ProgramData\\BKUgUgcg\\ayscUUEE.exe" ayscUUEE.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\XCEcgoIY.exe = "C:\\Users\\Admin\\nYwkcUws\\XCEcgoIY.exe" f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe -
Drops file in Windows directory 1 IoCs
Processes:
XCEcgoIY.exedescription ioc process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico XCEcgoIY.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 1772 reg.exe 296 reg.exe 1712 reg.exe 2660 reg.exe 1600 reg.exe 2856 reg.exe 848 reg.exe 1820 reg.exe 2276 reg.exe 1856 reg.exe 2564 reg.exe 2336 reg.exe 1744 reg.exe 2700 reg.exe 2832 reg.exe 1812 reg.exe 640 reg.exe 2456 reg.exe 2544 reg.exe 1636 reg.exe 2820 reg.exe 1712 reg.exe 2120 reg.exe 2756 reg.exe 2564 reg.exe 2136 reg.exe 1624 reg.exe 2304 reg.exe 2640 reg.exe 1656 reg.exe 3068 reg.exe 1216 reg.exe 1448 reg.exe 2444 reg.exe 920 reg.exe 1676 reg.exe 1832 reg.exe 1408 reg.exe 2132 reg.exe 896 reg.exe 2704 reg.exe 2812 reg.exe 1568 reg.exe 2116 reg.exe 1544 reg.exe 2624 reg.exe 2152 reg.exe 2084 reg.exe 2020 reg.exe 1656 reg.exe 2044 reg.exe 2152 reg.exe 1792 reg.exe 760 reg.exe 2820 reg.exe 1800 reg.exe 1740 reg.exe 800 reg.exe 2428 reg.exe 2988 reg.exe 2648 reg.exe 2760 reg.exe 1732 reg.exe 1408 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exepid process 2356 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2356 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2128 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2128 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2640 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2640 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2912 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2912 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2292 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2292 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 640 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 640 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 1096 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 1096 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2444 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2444 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 620 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 620 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2516 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2516 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 1696 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 1696 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2224 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2224 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 1872 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 1872 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2816 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2816 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2720 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2720 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 1964 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 1964 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 1848 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 1848 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 836 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 836 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2068 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2068 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 1508 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 1508 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2340 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2340 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 620 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 620 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 1080 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 1080 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2640 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2640 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 1588 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 1588 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 1792 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 1792 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 1796 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 1796 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 632 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 632 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2544 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2544 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 1708 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 1708 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 892 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 892 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2996 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2996 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
XCEcgoIY.exepid process 1312 XCEcgoIY.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
XCEcgoIY.exepid process 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe 1312 XCEcgoIY.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.execmd.execmd.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.execmd.execmd.exedescription pid process target process PID 2356 wrote to memory of 1312 2356 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe XCEcgoIY.exe PID 2356 wrote to memory of 1312 2356 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe XCEcgoIY.exe PID 2356 wrote to memory of 1312 2356 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe XCEcgoIY.exe PID 2356 wrote to memory of 1312 2356 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe XCEcgoIY.exe PID 2356 wrote to memory of 2208 2356 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe ayscUUEE.exe PID 2356 wrote to memory of 2208 2356 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe ayscUUEE.exe PID 2356 wrote to memory of 2208 2356 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe ayscUUEE.exe PID 2356 wrote to memory of 2208 2356 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe ayscUUEE.exe PID 2356 wrote to memory of 2692 2356 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe cmd.exe PID 2356 wrote to memory of 2692 2356 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe cmd.exe PID 2356 wrote to memory of 2692 2356 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe cmd.exe PID 2356 wrote to memory of 2692 2356 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe cmd.exe PID 2356 wrote to memory of 2732 2356 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 2356 wrote to memory of 2732 2356 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 2356 wrote to memory of 2732 2356 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 2356 wrote to memory of 2732 2356 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 2356 wrote to memory of 2580 2356 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 2356 wrote to memory of 2580 2356 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 2356 wrote to memory of 2580 2356 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 2356 wrote to memory of 2580 2356 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 2356 wrote to memory of 2724 2356 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 2356 wrote to memory of 2724 2356 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 2356 wrote to memory of 2724 2356 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 2356 wrote to memory of 2724 2356 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 2692 wrote to memory of 2128 2692 cmd.exe f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe PID 2692 wrote to memory of 2128 2692 cmd.exe f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe PID 2692 wrote to memory of 2128 2692 cmd.exe f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe PID 2692 wrote to memory of 2128 2692 cmd.exe f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe PID 2356 wrote to memory of 2816 2356 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe cmd.exe PID 2356 wrote to memory of 2816 2356 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe cmd.exe PID 2356 wrote to memory of 2816 2356 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe cmd.exe PID 2356 wrote to memory of 2816 2356 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe cmd.exe PID 2816 wrote to memory of 2468 2816 cmd.exe cscript.exe PID 2816 wrote to memory of 2468 2816 cmd.exe cscript.exe PID 2816 wrote to memory of 2468 2816 cmd.exe cscript.exe PID 2816 wrote to memory of 2468 2816 cmd.exe cscript.exe PID 2128 wrote to memory of 2660 2128 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe cmd.exe PID 2128 wrote to memory of 2660 2128 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe cmd.exe PID 2128 wrote to memory of 2660 2128 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe cmd.exe PID 2128 wrote to memory of 2660 2128 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe cmd.exe PID 2660 wrote to memory of 2640 2660 cmd.exe f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe PID 2660 wrote to memory of 2640 2660 cmd.exe f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe PID 2660 wrote to memory of 2640 2660 cmd.exe f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe PID 2660 wrote to memory of 2640 2660 cmd.exe f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe PID 2128 wrote to memory of 2624 2128 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 2128 wrote to memory of 2624 2128 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 2128 wrote to memory of 2624 2128 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 2128 wrote to memory of 2624 2128 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 2128 wrote to memory of 2760 2128 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 2128 wrote to memory of 2760 2128 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 2128 wrote to memory of 2760 2128 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 2128 wrote to memory of 2760 2128 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 2128 wrote to memory of 2824 2128 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 2128 wrote to memory of 2824 2128 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 2128 wrote to memory of 2824 2128 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 2128 wrote to memory of 2824 2128 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 2128 wrote to memory of 2836 2128 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe cmd.exe PID 2128 wrote to memory of 2836 2128 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe cmd.exe PID 2128 wrote to memory of 2836 2128 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe cmd.exe PID 2128 wrote to memory of 2836 2128 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe cmd.exe PID 2836 wrote to memory of 2332 2836 cmd.exe cscript.exe PID 2836 wrote to memory of 2332 2836 cmd.exe cscript.exe PID 2836 wrote to memory of 2332 2836 cmd.exe cscript.exe PID 2836 wrote to memory of 2332 2836 cmd.exe cscript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\nYwkcUws\XCEcgoIY.exe"C:\Users\Admin\nYwkcUws\XCEcgoIY.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\BKUgUgcg\ayscUUEE.exe"C:\ProgramData\BKUgUgcg\ayscUUEE.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"6⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"8⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"10⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"12⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"14⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"16⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"18⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"20⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"22⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"24⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"26⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"28⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"30⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"32⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"34⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics35⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"36⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics37⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"38⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics39⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"40⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics41⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"42⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics43⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"44⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics45⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"46⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics47⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"48⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics49⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"50⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics51⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"52⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics53⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"54⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics55⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"56⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics57⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"58⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics59⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"60⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics61⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"62⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics63⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"64⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics65⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"66⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics67⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"68⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics69⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"70⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics71⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"72⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics73⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"74⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics75⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"76⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics77⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"78⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics79⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"80⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics81⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"82⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics83⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"84⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics85⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"86⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics87⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"88⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics89⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"90⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics91⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"92⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics93⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"94⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics95⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"96⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics97⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"98⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics99⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"100⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics101⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"102⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics103⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"104⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics105⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"106⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics107⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"108⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics109⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"110⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics111⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"112⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics113⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"114⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics115⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"116⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics117⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"118⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics119⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"120⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics121⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"122⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics123⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"124⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics125⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"126⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics127⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"128⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics129⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"130⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics131⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"132⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics133⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"134⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics135⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"136⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics137⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"138⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics139⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"140⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics141⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"142⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics143⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"144⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics145⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"146⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics147⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"148⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics149⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"150⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics151⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"152⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics153⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"154⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics155⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"156⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics157⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"158⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics159⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"160⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics161⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"162⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics163⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"164⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics165⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"166⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics167⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"168⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics169⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"170⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics171⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"172⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics173⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"174⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics175⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"176⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics177⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"178⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics179⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"180⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics181⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"182⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics183⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"184⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics185⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"186⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics187⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"188⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics189⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"190⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics191⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"192⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics193⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"194⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics195⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"196⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics197⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"198⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics199⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"200⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics201⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"202⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics203⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"204⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics205⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"206⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics207⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"208⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics209⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"210⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics211⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"212⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics213⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"214⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics215⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"216⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics217⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"218⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics219⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"220⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics221⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"222⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics223⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"224⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics225⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"226⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics227⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"228⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics229⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"230⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics231⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"232⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics233⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"234⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics235⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"236⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics237⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"238⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics239⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"240⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics241⤵