Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 00:12
Static task
static1
Behavioral task
behavioral1
Sample
3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe
-
Size
193KB
-
MD5
3c82e02e0e6fbfe5e43567f7beab36c0
-
SHA1
965c4bb782941d95276b73186dd6fd6300a67fd7
-
SHA256
1634bf8ff10e04966861cef51062a21ef03ed5e73f836076295c0f02362e49a9
-
SHA512
3d43106316516e6b1f90f92f089e968abbf03a1830b10b38476ea01c823140fc98ce3a825f61de20c37be2fd551328ca983edd911931bc04124cd27274d43a4c
-
SSDEEP
3072:65Xf+PP6zDFD0kFtEDFwhP4EO2jq1cEMASFUOUmK79YqOPJx8:uP+I3/8w3rOeEKFUOUmK7G7f
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (100) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
qowAsAsw.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation qowAsAsw.exe -
Executes dropped EXE 2 IoCs
Processes:
qowAsAsw.exeuSkkQwIY.exepid process 3556 qowAsAsw.exe 2604 uSkkQwIY.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
uSkkQwIY.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeqowAsAsw.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uSkkQwIY.exe = "C:\\ProgramData\\omUcwscU\\uSkkQwIY.exe" uSkkQwIY.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qowAsAsw.exe = "C:\\Users\\Admin\\FwIIQYEM\\qowAsAsw.exe" 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uSkkQwIY.exe = "C:\\ProgramData\\omUcwscU\\uSkkQwIY.exe" 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qowAsAsw.exe = "C:\\Users\\Admin\\FwIIQYEM\\qowAsAsw.exe" qowAsAsw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 1684 2080 reg.exe 4808 reg.exe 3964 reg.exe 5056 reg.exe 2004 reg.exe 2008 reg.exe 4852 2772 reg.exe 4372 reg.exe 2924 reg.exe 1916 reg.exe 4944 reg.exe 456 reg.exe 2392 reg.exe 4272 reg.exe 3044 reg.exe 2712 reg.exe 3300 reg.exe 4968 reg.exe 1684 reg.exe 1632 reg.exe 4956 4084 reg.exe 5000 reg.exe 3292 reg.exe 3448 reg.exe 2804 reg.exe 4796 4028 1172 reg.exe 1620 reg.exe 4056 3896 1784 reg.exe 932 reg.exe 404 reg.exe 1648 reg.exe 1012 reg.exe 1628 reg.exe 1912 reg.exe 1368 reg.exe 4956 reg.exe 1884 reg.exe 2284 reg.exe 3224 reg.exe 3684 reg.exe 4848 reg.exe 916 reg.exe 1568 reg.exe 3512 reg.exe 916 reg.exe 4984 reg.exe 628 4468 reg.exe 3272 reg.exe 740 reg.exe 1012 reg.exe 4784 reg.exe 3540 400 reg.exe 2708 reg.exe 4468 2492 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exepid process 2676 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 2676 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 2676 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 2676 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 1076 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 1076 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 1076 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 1076 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 3668 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 3668 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 3668 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 3668 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 4948 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 4948 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 4948 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 4948 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 3320 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 3320 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 3320 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 3320 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 5040 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 5040 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 5040 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 5040 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 1512 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 1512 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 1512 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 1512 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 1956 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 1956 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 1956 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 1956 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 5076 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 5076 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 5076 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 5076 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 3792 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 3792 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 3792 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 3792 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 2668 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 2668 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 2668 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 2668 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 4480 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 4480 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 4480 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 4480 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 2348 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 2348 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 2348 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 2348 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 2628 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 2628 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 2628 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 2628 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 4928 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 4928 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 4928 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 4928 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 1620 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 1620 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 1620 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe 1620 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
qowAsAsw.exepid process 3556 qowAsAsw.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
qowAsAsw.exepid process 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe 3556 qowAsAsw.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.execmd.execmd.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.execmd.execmd.exe3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.execmd.exedescription pid process target process PID 2676 wrote to memory of 3556 2676 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe qowAsAsw.exe PID 2676 wrote to memory of 3556 2676 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe qowAsAsw.exe PID 2676 wrote to memory of 3556 2676 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe qowAsAsw.exe PID 2676 wrote to memory of 2604 2676 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe uSkkQwIY.exe PID 2676 wrote to memory of 2604 2676 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe uSkkQwIY.exe PID 2676 wrote to memory of 2604 2676 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe uSkkQwIY.exe PID 2676 wrote to memory of 2060 2676 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe cmd.exe PID 2676 wrote to memory of 2060 2676 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe cmd.exe PID 2676 wrote to memory of 2060 2676 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe cmd.exe PID 2060 wrote to memory of 1076 2060 cmd.exe 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe PID 2060 wrote to memory of 1076 2060 cmd.exe 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe PID 2060 wrote to memory of 1076 2060 cmd.exe 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe PID 2676 wrote to memory of 668 2676 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 2676 wrote to memory of 668 2676 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 2676 wrote to memory of 668 2676 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 2676 wrote to memory of 3744 2676 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 2676 wrote to memory of 3744 2676 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 2676 wrote to memory of 3744 2676 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 2676 wrote to memory of 4088 2676 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 2676 wrote to memory of 4088 2676 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 2676 wrote to memory of 4088 2676 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 2676 wrote to memory of 516 2676 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe cmd.exe PID 2676 wrote to memory of 516 2676 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe cmd.exe PID 2676 wrote to memory of 516 2676 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe cmd.exe PID 516 wrote to memory of 2768 516 cmd.exe cscript.exe PID 516 wrote to memory of 2768 516 cmd.exe cscript.exe PID 516 wrote to memory of 2768 516 cmd.exe cscript.exe PID 1076 wrote to memory of 860 1076 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe cmd.exe PID 1076 wrote to memory of 860 1076 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe cmd.exe PID 1076 wrote to memory of 860 1076 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe cmd.exe PID 1076 wrote to memory of 3648 1076 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 1076 wrote to memory of 3648 1076 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 1076 wrote to memory of 3648 1076 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 1076 wrote to memory of 2408 1076 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 1076 wrote to memory of 2408 1076 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 1076 wrote to memory of 2408 1076 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 1076 wrote to memory of 4140 1076 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 1076 wrote to memory of 4140 1076 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 1076 wrote to memory of 4140 1076 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 1076 wrote to memory of 4812 1076 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe cmd.exe PID 1076 wrote to memory of 4812 1076 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe cmd.exe PID 1076 wrote to memory of 4812 1076 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe cmd.exe PID 860 wrote to memory of 3668 860 cmd.exe 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe PID 860 wrote to memory of 3668 860 cmd.exe 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe PID 860 wrote to memory of 3668 860 cmd.exe 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe PID 4812 wrote to memory of 5048 4812 cmd.exe cscript.exe PID 4812 wrote to memory of 5048 4812 cmd.exe cscript.exe PID 4812 wrote to memory of 5048 4812 cmd.exe cscript.exe PID 3668 wrote to memory of 4220 3668 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe cmd.exe PID 3668 wrote to memory of 4220 3668 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe cmd.exe PID 3668 wrote to memory of 4220 3668 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe cmd.exe PID 4220 wrote to memory of 4948 4220 cmd.exe 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe PID 4220 wrote to memory of 4948 4220 cmd.exe 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe PID 4220 wrote to memory of 4948 4220 cmd.exe 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe PID 3668 wrote to memory of 676 3668 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 3668 wrote to memory of 676 3668 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 3668 wrote to memory of 676 3668 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 3668 wrote to memory of 4832 3668 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 3668 wrote to memory of 4832 3668 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 3668 wrote to memory of 4832 3668 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 3668 wrote to memory of 1792 3668 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 3668 wrote to memory of 1792 3668 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 3668 wrote to memory of 1792 3668 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe reg.exe PID 3668 wrote to memory of 1316 3668 3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\FwIIQYEM\qowAsAsw.exe"C:\Users\Admin\FwIIQYEM\qowAsAsw.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\omUcwscU\uSkkQwIY.exe"C:\ProgramData\omUcwscU\uSkkQwIY.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"8⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"10⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"12⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"14⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"16⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"18⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"20⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"22⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"24⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"26⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV127⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"28⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"30⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"32⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"34⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"36⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"38⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"40⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"42⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"44⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"46⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"48⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"50⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"52⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"54⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"56⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"58⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"60⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV161⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"62⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV163⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"64⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"66⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV167⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"68⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"70⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV171⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics71⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"72⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV173⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics73⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"74⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"76⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics77⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"78⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics79⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"80⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics81⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"82⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV183⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics83⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"84⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics85⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"86⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics87⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"88⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics89⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"90⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV191⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"92⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics93⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"94⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics95⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"96⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics97⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"98⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics99⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"100⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics101⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"102⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics103⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"104⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics105⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"106⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics107⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"108⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1109⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics109⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"110⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1111⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics111⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"112⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics113⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"114⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics115⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"116⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1117⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics117⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"118⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1119⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics119⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"120⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics121⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"122⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics123⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"124⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics125⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"126⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics127⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"128⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics129⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"130⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics131⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"132⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics133⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"134⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics135⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"136⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics137⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"138⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics139⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"140⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics141⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"142⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics143⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"144⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1145⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics145⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"146⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics147⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"148⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics149⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"150⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1151⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics151⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"152⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics153⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"154⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1155⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics155⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"156⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1157⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics157⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"158⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1159⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics159⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"160⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics161⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"162⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics163⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"164⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics165⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"166⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics167⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"168⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1169⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics169⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"170⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1171⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics171⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"172⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics173⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"174⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics175⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"176⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics177⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"178⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1179⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics179⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"180⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics181⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"182⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1183⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics183⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"184⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics185⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"186⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1187⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics187⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"188⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics189⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"190⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics191⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"192⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics193⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"194⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics195⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"196⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics197⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"198⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics199⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"200⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics201⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"202⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics203⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"204⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics205⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"206⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics207⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"208⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1209⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics209⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"210⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics211⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"212⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics213⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"214⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics215⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"216⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics217⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"218⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1219⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics219⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"220⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics221⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"222⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics223⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"224⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics225⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"226⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics227⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"228⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics229⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"230⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics231⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"232⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1233⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics233⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"234⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1235⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics235⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"236⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics237⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"238⤵
-
C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics239⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c82e02e0e6fbfe5e43567f7beab36c0_NeikiAnalytics"240⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1241⤵