Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 00:12
Static task
static1
Behavioral task
behavioral1
Sample
3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe
-
Size
193KB
-
MD5
3c82e02e0e6fbfe5e43567f7beab36c0
-
SHA1
965c4bb782941d95276b73186dd6fd6300a67fd7
-
SHA256
1634bf8ff10e04966861cef51062a21ef03ed5e73f836076295c0f02362e49a9
-
SHA512
3d43106316516e6b1f90f92f089e968abbf03a1830b10b38476ea01c823140fc98ce3a825f61de20c37be2fd551328ca983edd911931bc04124cd27274d43a4c
-
SSDEEP
3072:65Xf+PP6zDFD0kFtEDFwhP4EO2jq1cEMASFUOUmK79YqOPJx8:uP+I3/8w3rOeEKFUOUmK7G7f
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (57) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
HWoIYQQE.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Control Panel\International\Geo\Nation HWoIYQQE.exe -
Executes dropped EXE 2 IoCs
Processes:
HWoIYQQE.exeJuIcoksk.exepid process 3052 HWoIYQQE.exe 2596 JuIcoksk.exe -
Loads dropped DLL 20 IoCs
Processes:
3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeHWoIYQQE.exepid process 1992 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 1992 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 1992 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 1992 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeHWoIYQQE.exeJuIcoksk.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\HWoIYQQE.exe = "C:\\Users\\Admin\\eQQEMMsg\\HWoIYQQE.exe" 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JuIcoksk.exe = "C:\\ProgramData\\iMIksAIM\\JuIcoksk.exe" 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\HWoIYQQE.exe = "C:\\Users\\Admin\\eQQEMMsg\\HWoIYQQE.exe" HWoIYQQE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JuIcoksk.exe = "C:\\ProgramData\\iMIksAIM\\JuIcoksk.exe" JuIcoksk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\ZoYsEUEI.exe = "C:\\Users\\Admin\\XuMkEgco\\ZoYsEUEI.exe" 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\eQsoIMQY.exe = "C:\\ProgramData\\BCcYwkow\\eQsoIMQY.exe" 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe -
Drops file in Windows directory 1 IoCs
Processes:
HWoIYQQE.exedescription ioc process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico HWoIYQQE.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1628 1368 WerFault.exe ZoYsEUEI.exe 336 1584 WerFault.exe eQsoIMQY.exe -
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 1224 reg.exe 2308 reg.exe 716 reg.exe 2788 reg.exe 284 reg.exe 1540 reg.exe 1680 reg.exe 2620 reg.exe 996 reg.exe 1160 reg.exe 2236 reg.exe 2432 reg.exe 2132 reg.exe 1548 reg.exe 2232 reg.exe 812 reg.exe 448 reg.exe 2120 reg.exe 1800 reg.exe 1680 reg.exe 912 reg.exe 2784 reg.exe 2244 reg.exe 1412 reg.exe 2600 reg.exe 2508 reg.exe 836 reg.exe 816 reg.exe 2868 reg.exe 2148 reg.exe 2152 reg.exe 2332 reg.exe 1644 reg.exe 2304 reg.exe 1156 reg.exe 1316 reg.exe 472 reg.exe 1808 reg.exe 1700 reg.exe 2072 reg.exe 2224 reg.exe 2384 reg.exe 2356 reg.exe 1784 reg.exe 2788 reg.exe 1648 reg.exe 1524 reg.exe 3068 reg.exe 2324 reg.exe 2576 reg.exe 1568 reg.exe 2144 reg.exe 2528 reg.exe 580 reg.exe 2180 reg.exe 2948 reg.exe 2272 reg.exe 2908 reg.exe 2660 reg.exe 1124 reg.exe 2068 reg.exe 1440 reg.exe 1600 reg.exe 2140 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exepid process 1992 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 1992 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 2672 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 2672 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 1468 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 1468 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 1252 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 1252 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 796 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 796 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 2020 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 2020 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 2808 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 2808 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 2400 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 2400 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 2200 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 2200 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 1468 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 1468 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 1224 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 1224 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 1988 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 1988 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 2880 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 2880 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 2556 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 2556 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 860 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 860 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 968 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 968 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 2960 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 2960 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 1016 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 1016 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 1648 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 1648 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 1984 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 1984 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 472 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 472 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 272 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 272 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 2320 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 2320 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 2056 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 2056 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 2432 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 2432 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 2328 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 2328 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 1892 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 1892 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 1280 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 1280 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 968 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 968 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 2028 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 2028 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 2268 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 2268 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 2624 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 2624 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
HWoIYQQE.exepid process 3052 HWoIYQQE.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
HWoIYQQE.exepid process 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe 3052 HWoIYQQE.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.execmd.execmd.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.execmd.execmd.exedescription pid process target process PID 1992 wrote to memory of 3052 1992 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe HWoIYQQE.exe PID 1992 wrote to memory of 3052 1992 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe HWoIYQQE.exe PID 1992 wrote to memory of 3052 1992 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe HWoIYQQE.exe PID 1992 wrote to memory of 3052 1992 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe HWoIYQQE.exe PID 1992 wrote to memory of 2596 1992 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe JuIcoksk.exe PID 1992 wrote to memory of 2596 1992 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe JuIcoksk.exe PID 1992 wrote to memory of 2596 1992 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe JuIcoksk.exe PID 1992 wrote to memory of 2596 1992 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe JuIcoksk.exe PID 1992 wrote to memory of 2096 1992 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe cmd.exe PID 1992 wrote to memory of 2096 1992 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe cmd.exe PID 1992 wrote to memory of 2096 1992 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe cmd.exe PID 1992 wrote to memory of 2096 1992 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe cmd.exe PID 2096 wrote to memory of 2672 2096 cmd.exe 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe PID 2096 wrote to memory of 2672 2096 cmd.exe 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe PID 2096 wrote to memory of 2672 2096 cmd.exe 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe PID 2096 wrote to memory of 2672 2096 cmd.exe 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe PID 1992 wrote to memory of 2668 1992 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 1992 wrote to memory of 2668 1992 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 1992 wrote to memory of 2668 1992 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 1992 wrote to memory of 2668 1992 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 1992 wrote to memory of 2432 1992 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 1992 wrote to memory of 2432 1992 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 1992 wrote to memory of 2432 1992 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 1992 wrote to memory of 2432 1992 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 1992 wrote to memory of 2424 1992 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 1992 wrote to memory of 2424 1992 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 1992 wrote to memory of 2424 1992 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 1992 wrote to memory of 2424 1992 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 1992 wrote to memory of 2428 1992 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe cmd.exe PID 1992 wrote to memory of 2428 1992 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe cmd.exe PID 1992 wrote to memory of 2428 1992 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe cmd.exe PID 1992 wrote to memory of 2428 1992 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe cmd.exe PID 2428 wrote to memory of 1656 2428 cmd.exe cscript.exe PID 2428 wrote to memory of 1656 2428 cmd.exe cscript.exe PID 2428 wrote to memory of 1656 2428 cmd.exe cscript.exe PID 2428 wrote to memory of 1656 2428 cmd.exe cscript.exe PID 2672 wrote to memory of 1504 2672 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe cmd.exe PID 2672 wrote to memory of 1504 2672 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe cmd.exe PID 2672 wrote to memory of 1504 2672 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe cmd.exe PID 2672 wrote to memory of 1504 2672 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe cmd.exe PID 1504 wrote to memory of 1468 1504 cmd.exe 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe PID 1504 wrote to memory of 1468 1504 cmd.exe 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe PID 1504 wrote to memory of 1468 1504 cmd.exe 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe PID 1504 wrote to memory of 1468 1504 cmd.exe 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe PID 2672 wrote to memory of 312 2672 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 2672 wrote to memory of 312 2672 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 2672 wrote to memory of 312 2672 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 2672 wrote to memory of 312 2672 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 2672 wrote to memory of 1724 2672 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 2672 wrote to memory of 1724 2672 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 2672 wrote to memory of 1724 2672 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 2672 wrote to memory of 1724 2672 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 2672 wrote to memory of 1360 2672 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 2672 wrote to memory of 1360 2672 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 2672 wrote to memory of 1360 2672 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 2672 wrote to memory of 1360 2672 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 2672 wrote to memory of 2180 2672 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe cmd.exe PID 2672 wrote to memory of 2180 2672 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe cmd.exe PID 2672 wrote to memory of 2180 2672 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe cmd.exe PID 2672 wrote to memory of 2180 2672 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe cmd.exe PID 2180 wrote to memory of 1524 2180 cmd.exe cscript.exe PID 2180 wrote to memory of 1524 2180 cmd.exe cscript.exe PID 2180 wrote to memory of 1524 2180 cmd.exe cscript.exe PID 2180 wrote to memory of 1524 2180 cmd.exe cscript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\eQQEMMsg\HWoIYQQE.exe"C:\Users\Admin\eQQEMMsg\HWoIYQQE.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\iMIksAIM\JuIcoksk.exe"C:\ProgramData\iMIksAIM\JuIcoksk.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"6⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"8⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"10⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"12⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"14⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"16⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"18⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"20⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"22⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"24⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"26⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"28⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"30⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"32⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"34⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics35⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"36⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics37⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"38⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics39⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"40⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics41⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"42⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics43⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"44⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics45⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"46⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics47⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"48⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics49⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"50⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics51⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"52⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics53⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"54⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics55⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"56⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics57⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"58⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics59⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"60⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics61⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"62⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics63⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"64⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics65⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"66⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics67⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"68⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics69⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"70⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics71⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"72⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics73⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"74⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics75⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"76⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics77⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"78⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics79⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"80⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics81⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"82⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics83⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"84⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics85⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"86⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics87⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"88⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics89⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"90⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics91⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"92⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics93⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"94⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics95⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"96⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics97⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"98⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics99⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"100⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics101⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"102⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics103⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"104⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics105⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"106⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics107⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"108⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics109⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"110⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics111⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"112⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics113⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"114⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics115⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"116⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics117⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"118⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics119⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"120⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics121⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"122⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics123⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"124⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics125⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"126⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics127⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"128⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics129⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"130⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics131⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"132⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics133⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"134⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics135⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"136⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics137⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"138⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics139⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"140⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics141⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"142⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics143⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"144⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics145⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"146⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics147⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"148⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics149⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"150⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics151⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"152⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics153⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"154⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics155⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"156⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics157⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"158⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics159⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"160⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics161⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"162⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics163⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"164⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics165⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"166⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics167⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"168⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics169⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"170⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics171⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"172⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics173⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"174⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics175⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"176⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics177⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"178⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics179⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"180⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics181⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"182⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics183⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"184⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics185⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"186⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics187⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"188⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics189⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"190⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics191⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"192⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics193⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"194⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics195⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"196⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics197⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"198⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics199⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"200⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics201⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"202⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics203⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"204⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics205⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"206⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics207⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"208⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics209⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"210⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics211⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"212⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics213⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"214⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics215⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"216⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics217⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"218⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics219⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"220⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics221⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"222⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics223⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"224⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics225⤵
- Adds Run key to start application
-
C:\Users\Admin\XuMkEgco\ZoYsEUEI.exe"C:\Users\Admin\XuMkEgco\ZoYsEUEI.exe"226⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 36227⤵
- Program crash
-
C:\ProgramData\BCcYwkow\eQsoIMQY.exe"C:\ProgramData\BCcYwkow\eQsoIMQY.exe"226⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1584 -s 36227⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"226⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics227⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"228⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics229⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"230⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics231⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"232⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics233⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"234⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics235⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"236⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics237⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"238⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics239⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"240⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics241⤵