Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 16:25
Static task
static1
Behavioral task
behavioral1
Sample
710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe
-
Size
191KB
-
MD5
710c4a77cf07ffd806e0cc60e837cb10
-
SHA1
e2d9719ea89288a872156a52b4a73801163dca48
-
SHA256
727dd0e15f2f47a4783cc6db548243fccb2b8e34cae35b00c0848e741388ac42
-
SHA512
0edb053c63290b411b06f15167b328358075fb377d4d8b276ac72dc0b976b21ba7e970d454dbc8dfaf1424458232e23bf103052279dcc1e0da6023404a6062b3
-
SSDEEP
3072:PMCGKtFAO6en/0Iyq2021ly+ufsnOGPyyKE7VjqDT5hzZ/D7BoBS70h6L3e:PMAFAO6MtF2pOGPdVK5fuGre
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (52) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
CScEcAEY.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Control Panel\International\Geo\Nation CScEcAEY.exe -
Executes dropped EXE 2 IoCs
Processes:
CScEcAEY.execWoUsgQs.exepid process 2964 CScEcAEY.exe 2524 cWoUsgQs.exe -
Loads dropped DLL 20 IoCs
Processes:
710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeCScEcAEY.exepid process 2932 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 2932 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 2932 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 2932 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
CScEcAEY.execWoUsgQs.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\CScEcAEY.exe = "C:\\Users\\Admin\\oKUkoAIw\\CScEcAEY.exe" CScEcAEY.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cWoUsgQs.exe = "C:\\ProgramData\\EucwkssI\\cWoUsgQs.exe" cWoUsgQs.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\CScEcAEY.exe = "C:\\Users\\Admin\\oKUkoAIw\\CScEcAEY.exe" 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cWoUsgQs.exe = "C:\\ProgramData\\EucwkssI\\cWoUsgQs.exe" 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 2332 reg.exe 916 reg.exe 644 reg.exe 2000 reg.exe 1176 reg.exe 2556 reg.exe 2432 reg.exe 1636 reg.exe 1256 reg.exe 2584 reg.exe 1932 reg.exe 2696 reg.exe 1688 reg.exe 1420 reg.exe 1736 reg.exe 2976 reg.exe 1540 reg.exe 2008 reg.exe 1756 reg.exe 240 reg.exe 2844 reg.exe 2016 reg.exe 2736 reg.exe 1116 reg.exe 1116 reg.exe 828 reg.exe 2512 reg.exe 2676 reg.exe 1216 reg.exe 3036 reg.exe 1808 reg.exe 2544 reg.exe 2168 reg.exe 1816 reg.exe 2900 reg.exe 2984 reg.exe 712 reg.exe 408 reg.exe 2876 reg.exe 1900 reg.exe 2304 reg.exe 2560 reg.exe 2372 reg.exe 3036 reg.exe 896 reg.exe 2512 reg.exe 2860 reg.exe 2168 reg.exe 1928 reg.exe 1564 reg.exe 3004 reg.exe 876 reg.exe 2416 reg.exe 860 reg.exe 652 reg.exe 784 reg.exe 2624 reg.exe 1796 reg.exe 2672 reg.exe 2456 reg.exe 2124 reg.exe 2472 reg.exe 2340 reg.exe 2428 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exepid process 2932 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 2932 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 2808 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 2808 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 2780 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 2780 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 2164 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 2164 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 2364 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 2364 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 1368 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 1368 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 1440 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 1440 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 2672 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 2672 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 1608 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 1608 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 2788 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 2788 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 2176 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 2176 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 2364 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 2364 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 272 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 272 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 2600 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 2600 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 2728 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 2728 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 1176 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 1176 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 1448 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 1448 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 916 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 916 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 2560 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 2560 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 2000 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 2000 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 2448 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 2448 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 2728 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 2728 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 1892 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 1892 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 928 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 928 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 1368 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 1368 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 2476 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 2476 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 2760 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 2760 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 1612 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 1612 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 604 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 604 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 3044 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 3044 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 2928 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 2928 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 1444 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe 1444 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
CScEcAEY.exepid process 2964 CScEcAEY.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
CScEcAEY.exepid process 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe 2964 CScEcAEY.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.execmd.execmd.exe710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.execmd.execmd.exedescription pid process target process PID 2932 wrote to memory of 2964 2932 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe CScEcAEY.exe PID 2932 wrote to memory of 2964 2932 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe CScEcAEY.exe PID 2932 wrote to memory of 2964 2932 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe CScEcAEY.exe PID 2932 wrote to memory of 2964 2932 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe CScEcAEY.exe PID 2932 wrote to memory of 2524 2932 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe cWoUsgQs.exe PID 2932 wrote to memory of 2524 2932 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe cWoUsgQs.exe PID 2932 wrote to memory of 2524 2932 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe cWoUsgQs.exe PID 2932 wrote to memory of 2524 2932 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe cWoUsgQs.exe PID 2932 wrote to memory of 2812 2932 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe cmd.exe PID 2932 wrote to memory of 2812 2932 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe cmd.exe PID 2932 wrote to memory of 2812 2932 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe cmd.exe PID 2932 wrote to memory of 2812 2932 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe cmd.exe PID 2812 wrote to memory of 2808 2812 cmd.exe 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe PID 2812 wrote to memory of 2808 2812 cmd.exe 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe PID 2812 wrote to memory of 2808 2812 cmd.exe 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe PID 2812 wrote to memory of 2808 2812 cmd.exe 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe PID 2932 wrote to memory of 2680 2932 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 2932 wrote to memory of 2680 2932 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 2932 wrote to memory of 2680 2932 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 2932 wrote to memory of 2680 2932 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 2932 wrote to memory of 2456 2932 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 2932 wrote to memory of 2456 2932 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 2932 wrote to memory of 2456 2932 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 2932 wrote to memory of 2456 2932 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 2932 wrote to memory of 2696 2932 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 2932 wrote to memory of 2696 2932 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 2932 wrote to memory of 2696 2932 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 2932 wrote to memory of 2696 2932 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 2932 wrote to memory of 2588 2932 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe cmd.exe PID 2932 wrote to memory of 2588 2932 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe cmd.exe PID 2932 wrote to memory of 2588 2932 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe cmd.exe PID 2932 wrote to memory of 2588 2932 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe cmd.exe PID 2588 wrote to memory of 2492 2588 cmd.exe cscript.exe PID 2588 wrote to memory of 2492 2588 cmd.exe cscript.exe PID 2588 wrote to memory of 2492 2588 cmd.exe cscript.exe PID 2588 wrote to memory of 2492 2588 cmd.exe cscript.exe PID 2808 wrote to memory of 2732 2808 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe cmd.exe PID 2808 wrote to memory of 2732 2808 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe cmd.exe PID 2808 wrote to memory of 2732 2808 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe cmd.exe PID 2808 wrote to memory of 2732 2808 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe cmd.exe PID 2732 wrote to memory of 2780 2732 cmd.exe 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe PID 2732 wrote to memory of 2780 2732 cmd.exe 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe PID 2732 wrote to memory of 2780 2732 cmd.exe 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe PID 2732 wrote to memory of 2780 2732 cmd.exe 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe PID 2808 wrote to memory of 2792 2808 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 2808 wrote to memory of 2792 2808 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 2808 wrote to memory of 2792 2808 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 2808 wrote to memory of 2792 2808 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 2808 wrote to memory of 1636 2808 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 2808 wrote to memory of 1636 2808 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 2808 wrote to memory of 1636 2808 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 2808 wrote to memory of 1636 2808 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 2808 wrote to memory of 1772 2808 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 2808 wrote to memory of 1772 2808 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 2808 wrote to memory of 1772 2808 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 2808 wrote to memory of 1772 2808 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe reg.exe PID 2808 wrote to memory of 1580 2808 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe cmd.exe PID 2808 wrote to memory of 1580 2808 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe cmd.exe PID 2808 wrote to memory of 1580 2808 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe cmd.exe PID 2808 wrote to memory of 1580 2808 710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe cmd.exe PID 1580 wrote to memory of 1560 1580 cmd.exe cscript.exe PID 1580 wrote to memory of 1560 1580 cmd.exe cscript.exe PID 1580 wrote to memory of 1560 1580 cmd.exe cscript.exe PID 1580 wrote to memory of 1560 1580 cmd.exe cscript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\oKUkoAIw\CScEcAEY.exe"C:\Users\Admin\oKUkoAIw\CScEcAEY.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\EucwkssI\cWoUsgQs.exe"C:\ProgramData\EucwkssI\cWoUsgQs.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"6⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"8⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"10⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"12⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"14⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"16⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"18⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"20⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"22⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"24⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"26⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"28⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"30⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"32⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"34⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics35⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"36⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics37⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"38⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics39⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"40⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics41⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"42⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics43⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"44⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics45⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"46⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics47⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"48⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics49⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"50⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics51⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"52⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics53⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"54⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics55⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"56⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics57⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"58⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics59⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"60⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics61⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"62⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics63⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"64⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics65⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"66⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics67⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"68⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics69⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"70⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics71⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"72⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics73⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"74⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics75⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"76⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics77⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"78⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics79⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"80⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics81⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"82⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics83⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"84⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics85⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"86⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics87⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"88⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics89⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"90⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics91⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"92⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics93⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"94⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics95⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"96⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics97⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"98⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics99⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"100⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics101⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"102⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics103⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"104⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics105⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"106⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics107⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"108⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics109⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"110⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics111⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"112⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics113⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"114⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics115⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"116⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics117⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"118⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics119⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"120⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics121⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"122⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics123⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"124⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics125⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"126⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics127⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"128⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics129⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"130⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics131⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"132⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics133⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"134⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics135⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"136⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics137⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"138⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics139⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"140⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics141⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"142⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics143⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"144⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics145⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"146⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics147⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"148⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics149⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"150⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics151⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"152⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics153⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"154⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics155⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"156⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics157⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"158⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics159⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"160⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics161⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"162⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics163⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"164⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics165⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"166⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics167⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"168⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics169⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"170⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics171⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"172⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics173⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"174⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics175⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"176⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics177⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"178⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics179⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"180⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics181⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"182⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics183⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"184⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics185⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"186⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics187⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"188⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics189⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"190⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics191⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"192⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics193⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"194⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics195⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"196⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics197⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"198⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics199⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"200⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics201⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"202⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics203⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"204⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics205⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"206⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics207⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"208⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics209⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"210⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics211⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"212⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics213⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"214⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics215⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"216⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics217⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"218⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics219⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"220⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics221⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"222⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics223⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"224⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics225⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"226⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics227⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"228⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics229⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"230⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics231⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"232⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics233⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"234⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics235⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"236⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics237⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"238⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics239⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics"240⤵
-
C:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\710c4a77cf07ffd806e0cc60e837cb10_NeikiAnalytics241⤵