Analysis
-
max time kernel
150s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 08:28
Static task
static1
Behavioral task
behavioral1
Sample
f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe
-
Size
202KB
-
MD5
f7161f431e5ffd38b200f70b967f01c0
-
SHA1
34e875f7682d942696525e20470f6f586d6cd4f8
-
SHA256
dc921bbe8fd76aead5cd7f1e1e83182af90b59ab2a463ebcbfa73baa428c38b1
-
SHA512
7c004cf06f7ab6d249f57fa47049ed242693e74e5dac37ea0c3fc4f782976d1bccb90476c13b14bdcc288711714eef4166a912fb88b63de97675e3686f3f88cf
-
SSDEEP
3072:yCXKPODMyOLH4x93AiDS3zzvMHuxfq0276HoWlrC912rZZH/8UIQT2t35yB:mmn13f5WoPsZBfEt35y
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (73) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
IAEUMYUE.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation IAEUMYUE.exe -
Executes dropped EXE 4 IoCs
Processes:
IAEUMYUE.exehMsockII.exepid process 4584 IAEUMYUE.exe 3864 hMsockII.exe 4968 3676 -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeIAEUMYUE.exehMsockII.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PyQgcwkc.exe = "C:\\ProgramData\\uUYsUYsY\\PyQgcwkc.exe" Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IAEUMYUE.exe = "C:\\Users\\Admin\\QAIoYwoI\\IAEUMYUE.exe" f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hMsockII.exe = "C:\\ProgramData\\PmMEAswM\\hMsockII.exe" f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IAEUMYUE.exe = "C:\\Users\\Admin\\QAIoYwoI\\IAEUMYUE.exe" IAEUMYUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hMsockII.exe = "C:\\ProgramData\\PmMEAswM\\hMsockII.exe" hMsockII.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OYskwcos.exe = "C:\\Users\\Admin\\VQcQYcIc\\OYskwcos.exe" f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PyQgcwkc.exe = "C:\\ProgramData\\uUYsUYsY\\PyQgcwkc.exe" f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OYskwcos.exe = "C:\\Users\\Admin\\VQcQYcIc\\OYskwcos.exe" -
Drops file in System32 directory 2 IoCs
Processes:
IAEUMYUE.exedescription ioc process File created C:\Windows\SysWOW64\shell32.dll.exe IAEUMYUE.exe File opened for modification C:\Windows\SysWOW64\shell32.dll.exe IAEUMYUE.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4724 3020 WerFault.exe PyQgcwkc.exe 1740 4492 WerFault.exe OYskwcos.exe 5112 4968 3304 3676 -
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 1204 reg.exe 2920 reg.exe 3212 reg.exe 4836 reg.exe 4308 reg.exe 4448 reg.exe 2340 reg.exe 3940 reg.exe 3280 reg.exe 4812 reg.exe 4800 reg.exe 4056 reg.exe 2244 reg.exe 4968 reg.exe 528 reg.exe 3488 reg.exe 4448 reg.exe 2120 reg.exe 2712 reg.exe 4596 reg.exe 4088 reg.exe 4856 reg.exe 1800 reg.exe 4084 reg.exe 1664 reg.exe 2404 reg.exe 4476 reg.exe 4596 reg.exe 2884 reg.exe 2352 reg.exe 4476 reg.exe 4868 reg.exe 4992 reg.exe 752 reg.exe 2716 reg.exe 3432 reg.exe 4480 reg.exe 4892 reg.exe 2432 reg.exe 3428 reg.exe 1120 reg.exe 3960 reg.exe 868 reg.exe 2292 reg.exe 3360 1068 reg.exe 2880 reg.exe 4828 reg.exe 4508 reg.exe 3752 reg.exe 4852 reg.exe 324 reg.exe 2792 reg.exe 4828 1432 reg.exe 1716 reg.exe 1464 4556 reg.exe 2716 reg.exe 2864 reg.exe 4596 reg.exe 1416 reg.exe 1864 reg.exe 3872 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exepid process 1048 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 1048 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 1048 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 1048 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 3388 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 3388 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 3388 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 3388 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2712 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2712 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2712 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2712 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 1744 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 1744 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 1744 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 1744 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2848 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2848 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2848 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2848 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 3704 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 3704 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 3704 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 3704 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 3216 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 3216 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 3216 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 3216 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2884 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2884 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2884 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2884 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 4636 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 4636 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 4636 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 4636 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 3800 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 3800 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 3800 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 3800 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 1496 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 1496 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 1496 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 1496 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 3296 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 3296 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 3296 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 3296 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2548 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2548 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2548 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2548 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 3724 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 3724 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 3724 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 3724 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2352 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2352 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2352 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 2352 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 4580 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 4580 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 4580 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe 4580 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
IAEUMYUE.exepid process 4584 IAEUMYUE.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
IAEUMYUE.exepid process 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe 4584 IAEUMYUE.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.execmd.execmd.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.execmd.execmd.exef7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.execmd.exedescription pid process target process PID 1048 wrote to memory of 4584 1048 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe IAEUMYUE.exe PID 1048 wrote to memory of 4584 1048 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe IAEUMYUE.exe PID 1048 wrote to memory of 4584 1048 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe IAEUMYUE.exe PID 1048 wrote to memory of 3864 1048 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe hMsockII.exe PID 1048 wrote to memory of 3864 1048 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe hMsockII.exe PID 1048 wrote to memory of 3864 1048 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe hMsockII.exe PID 1048 wrote to memory of 3428 1048 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe cmd.exe PID 1048 wrote to memory of 3428 1048 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe cmd.exe PID 1048 wrote to memory of 3428 1048 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe cmd.exe PID 3428 wrote to memory of 3388 3428 cmd.exe f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe PID 3428 wrote to memory of 3388 3428 cmd.exe f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe PID 3428 wrote to memory of 3388 3428 cmd.exe f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe PID 1048 wrote to memory of 2672 1048 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 1048 wrote to memory of 2672 1048 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 1048 wrote to memory of 2672 1048 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 1048 wrote to memory of 4044 1048 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 1048 wrote to memory of 4044 1048 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 1048 wrote to memory of 4044 1048 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 1048 wrote to memory of 4312 1048 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 1048 wrote to memory of 4312 1048 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 1048 wrote to memory of 4312 1048 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 1048 wrote to memory of 3724 1048 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe cmd.exe PID 1048 wrote to memory of 3724 1048 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe cmd.exe PID 1048 wrote to memory of 3724 1048 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe cmd.exe PID 3724 wrote to memory of 3192 3724 cmd.exe cscript.exe PID 3724 wrote to memory of 3192 3724 cmd.exe cscript.exe PID 3724 wrote to memory of 3192 3724 cmd.exe cscript.exe PID 3388 wrote to memory of 5112 3388 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe cmd.exe PID 3388 wrote to memory of 5112 3388 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe cmd.exe PID 3388 wrote to memory of 5112 3388 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe cmd.exe PID 5112 wrote to memory of 2712 5112 cmd.exe f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe PID 5112 wrote to memory of 2712 5112 cmd.exe f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe PID 5112 wrote to memory of 2712 5112 cmd.exe f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe PID 3388 wrote to memory of 644 3388 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 3388 wrote to memory of 644 3388 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 3388 wrote to memory of 644 3388 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 3388 wrote to memory of 1444 3388 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 3388 wrote to memory of 1444 3388 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 3388 wrote to memory of 1444 3388 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 3388 wrote to memory of 4868 3388 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 3388 wrote to memory of 4868 3388 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 3388 wrote to memory of 4868 3388 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 3388 wrote to memory of 1576 3388 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe cmd.exe PID 3388 wrote to memory of 1576 3388 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe cmd.exe PID 3388 wrote to memory of 1576 3388 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe cmd.exe PID 1576 wrote to memory of 1984 1576 cmd.exe cscript.exe PID 1576 wrote to memory of 1984 1576 cmd.exe cscript.exe PID 1576 wrote to memory of 1984 1576 cmd.exe cscript.exe PID 2712 wrote to memory of 3576 2712 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe cmd.exe PID 2712 wrote to memory of 3576 2712 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe cmd.exe PID 2712 wrote to memory of 3576 2712 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe cmd.exe PID 3576 wrote to memory of 1744 3576 cmd.exe f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe PID 3576 wrote to memory of 1744 3576 cmd.exe f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe PID 3576 wrote to memory of 1744 3576 cmd.exe f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe PID 2712 wrote to memory of 4600 2712 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 2712 wrote to memory of 4600 2712 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 2712 wrote to memory of 4600 2712 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 2712 wrote to memory of 3828 2712 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 2712 wrote to memory of 3828 2712 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 2712 wrote to memory of 3828 2712 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 2712 wrote to memory of 4568 2712 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 2712 wrote to memory of 4568 2712 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 2712 wrote to memory of 4568 2712 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe reg.exe PID 2712 wrote to memory of 3928 2712 f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\QAIoYwoI\IAEUMYUE.exe"C:\Users\Admin\QAIoYwoI\IAEUMYUE.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\PmMEAswM\hMsockII.exe"C:\ProgramData\PmMEAswM\hMsockII.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"8⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"10⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"12⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"14⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"16⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"18⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"20⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"22⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"24⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV125⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"26⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"28⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"30⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"32⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"34⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"36⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"38⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"40⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"42⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"44⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"46⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"48⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"50⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics51⤵
- Adds Run key to start application
-
C:\Users\Admin\VQcQYcIc\OYskwcos.exe"C:\Users\Admin\VQcQYcIc\OYskwcos.exe"52⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4492 -s 22453⤵
- Program crash
-
C:\ProgramData\uUYsUYsY\PyQgcwkc.exe"C:\ProgramData\uUYsUYsY\PyQgcwkc.exe"52⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 22053⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"52⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"54⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"56⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV157⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"58⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"60⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"62⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"64⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"66⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"68⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"70⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics71⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"72⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics73⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"74⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"76⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics77⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"78⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV179⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics79⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"80⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics81⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"82⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics83⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"84⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics85⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"86⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics87⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"88⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics89⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"90⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV191⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"92⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics93⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"94⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics95⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"96⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV197⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics97⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"98⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV199⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics99⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"100⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics101⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"102⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1103⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics103⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"104⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics105⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"106⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics107⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"108⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics109⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"110⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics111⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"112⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1113⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics113⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"114⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics115⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"116⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics117⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"118⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1119⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics119⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"120⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics121⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"122⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1123⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics123⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"124⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics125⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"126⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1127⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics127⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"128⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics129⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"130⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics131⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"132⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics133⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"134⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics135⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"136⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics137⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"138⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics139⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"140⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1141⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics141⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"142⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics143⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"144⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics145⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"146⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics147⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"148⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics149⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"150⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1151⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics151⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"152⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1153⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics153⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"154⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics155⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"156⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1157⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics157⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"158⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics159⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"160⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics161⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"162⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1163⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics163⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"164⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics165⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"166⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics167⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"168⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics169⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"170⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics171⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"172⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics173⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"174⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics175⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"176⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics177⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"178⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics179⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"180⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1181⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics181⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"182⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics183⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"184⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1185⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics185⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"186⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics187⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"188⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics189⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"190⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics191⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"192⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics193⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"194⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1195⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics195⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"196⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics197⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"198⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics199⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"200⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics201⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"202⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics203⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"204⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics205⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"206⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics207⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"208⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics209⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"210⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics211⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"212⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics213⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"214⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1215⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics215⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"216⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1217⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics217⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"218⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics219⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"220⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics221⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"222⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics223⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"224⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics225⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"226⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics227⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"228⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics229⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"230⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1231⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics231⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"232⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics233⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"234⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics235⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"236⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1237⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics237⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"238⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics239⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics"240⤵
-
C:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\f7161f431e5ffd38b200f70b967f01c0_NeikiAnalytics241⤵