Analysis
-
max time kernel
150s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 04:03
Static task
static1
Behavioral task
behavioral1
Sample
60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe
-
Size
209KB
-
MD5
60e52e5583a2290d74f0eeb48d2fe6a0
-
SHA1
264f92259d649a8e76a80b1fd5ef75dbb4e2d259
-
SHA256
b43b7d0a3dc11f47e85c546e57c0ec7e0a5e945c3abeb5f1a185434e82503f22
-
SHA512
88e1ab57baa369dd718c2ab5834b11dcc6b1a8a759f8c4461d90d0d759dfa70621cb703085c80e6f8426da381bb133e2f3788e9ed9d96ee9f312d92d207f61b0
-
SSDEEP
3072:5pr0dHh6GXiXkIMUra5R1HLI6pFKUiMalO8yjH6nxaRSSealtIb9HQ/m65HNurm6:5prGFIza57I85iMao8yj4x+mHuz5Lju
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (74) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
UMEwkUQU.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation UMEwkUQU.exe -
Executes dropped EXE 2 IoCs
Processes:
jIkooUIU.exeUMEwkUQU.exepid process 4836 jIkooUIU.exe 4852 UMEwkUQU.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
UMEwkUQU.exejIkooUIU.exe60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UMEwkUQU.exe = "C:\\ProgramData\\pkkEQMMI\\UMEwkUQU.exe" UMEwkUQU.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jIkooUIU.exe = "C:\\Users\\Admin\\SSUksUcM\\jIkooUIU.exe" jIkooUIU.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jIkooUIU.exe = "C:\\Users\\Admin\\SSUksUcM\\jIkooUIU.exe" 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UMEwkUQU.exe = "C:\\ProgramData\\pkkEQMMI\\UMEwkUQU.exe" 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe -
Drops file in System32 directory 2 IoCs
Processes:
UMEwkUQU.exedescription ioc process File created C:\Windows\SysWOW64\shell32.dll.exe UMEwkUQU.exe File opened for modification C:\Windows\SysWOW64\shell32.dll.exe UMEwkUQU.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 4632 reg.exe 4016 reg.exe 1620 reg.exe 2332 2236 4428 reg.exe 824 reg.exe 2388 reg.exe 3144 3208 reg.exe 4300 reg.exe 3352 reg.exe 4684 reg.exe 4132 reg.exe 996 reg.exe 4704 reg.exe 2588 reg.exe 3204 reg.exe 208 reg.exe 2548 reg.exe 1984 reg.exe 4328 reg.exe 1864 reg.exe 2440 reg.exe 1784 1060 reg.exe 620 reg.exe 4584 reg.exe 696 reg.exe 3440 reg.exe 2336 reg.exe 4032 reg.exe 3144 reg.exe 2816 reg.exe 2644 reg.exe 4688 reg.exe 3208 reg.exe 1820 reg.exe 2852 reg.exe 1008 reg.exe 4988 reg.exe 5016 2516 reg.exe 8 reg.exe 3144 reg.exe 4924 reg.exe 3368 reg.exe 2044 reg.exe 3240 reg.exe 3848 reg.exe 1228 reg.exe 1056 reg.exe 2556 reg.exe 1944 reg.exe 5004 reg.exe 2208 reg.exe 4632 reg.exe 4424 reg.exe 3012 reg.exe 1204 reg.exe 1280 reg.exe 532 reg.exe 1496 reg.exe 4496 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exepid process 816 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 816 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 816 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 816 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 4036 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 4036 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 4036 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 4036 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 3516 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 3516 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 3516 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 3516 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 2720 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 2720 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 2720 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 2720 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 4452 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 4452 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 4452 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 4452 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 3920 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 3920 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 3920 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 3920 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 4444 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 4444 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 4444 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 4444 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 3964 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 3964 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 3964 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 3964 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 4628 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 4628 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 4628 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 4628 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 3656 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 3656 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 3656 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 3656 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 964 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 964 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 964 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 964 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 2076 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 2076 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 2076 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 2076 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 332 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 332 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 332 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 332 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 1920 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 1920 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 1920 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 1920 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 1824 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 1824 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 1824 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 1824 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 1644 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 1644 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 1644 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe 1644 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
UMEwkUQU.exepid process 4852 UMEwkUQU.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
UMEwkUQU.exepid process 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe 4852 UMEwkUQU.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.execmd.exe60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.execmd.execmd.execmd.exe60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.execmd.exedescription pid process target process PID 816 wrote to memory of 4836 816 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe jIkooUIU.exe PID 816 wrote to memory of 4836 816 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe jIkooUIU.exe PID 816 wrote to memory of 4836 816 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe jIkooUIU.exe PID 816 wrote to memory of 4852 816 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe UMEwkUQU.exe PID 816 wrote to memory of 4852 816 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe UMEwkUQU.exe PID 816 wrote to memory of 4852 816 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe UMEwkUQU.exe PID 816 wrote to memory of 4148 816 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe cmd.exe PID 816 wrote to memory of 4148 816 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe cmd.exe PID 816 wrote to memory of 4148 816 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe cmd.exe PID 4148 wrote to memory of 4036 4148 cmd.exe 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe PID 4148 wrote to memory of 4036 4148 cmd.exe 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe PID 4148 wrote to memory of 4036 4148 cmd.exe 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe PID 816 wrote to memory of 2852 816 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe reg.exe PID 816 wrote to memory of 2852 816 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe reg.exe PID 816 wrote to memory of 2852 816 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe reg.exe PID 816 wrote to memory of 620 816 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe reg.exe PID 816 wrote to memory of 620 816 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe reg.exe PID 816 wrote to memory of 620 816 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe reg.exe PID 816 wrote to memory of 2732 816 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe reg.exe PID 816 wrote to memory of 2732 816 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe reg.exe PID 816 wrote to memory of 2732 816 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe reg.exe PID 816 wrote to memory of 5088 816 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe cmd.exe PID 816 wrote to memory of 5088 816 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe cmd.exe PID 816 wrote to memory of 5088 816 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe cmd.exe PID 4036 wrote to memory of 2860 4036 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe cmd.exe PID 4036 wrote to memory of 2860 4036 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe cmd.exe PID 4036 wrote to memory of 2860 4036 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe cmd.exe PID 5088 wrote to memory of 2644 5088 cmd.exe cscript.exe PID 5088 wrote to memory of 2644 5088 cmd.exe cscript.exe PID 5088 wrote to memory of 2644 5088 cmd.exe cscript.exe PID 2860 wrote to memory of 3516 2860 cmd.exe 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe PID 2860 wrote to memory of 3516 2860 cmd.exe 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe PID 2860 wrote to memory of 3516 2860 cmd.exe 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe PID 4036 wrote to memory of 3124 4036 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe reg.exe PID 4036 wrote to memory of 3124 4036 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe reg.exe PID 4036 wrote to memory of 3124 4036 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe reg.exe PID 4036 wrote to memory of 4132 4036 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe reg.exe PID 4036 wrote to memory of 4132 4036 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe reg.exe PID 4036 wrote to memory of 4132 4036 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe reg.exe PID 4036 wrote to memory of 1420 4036 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe reg.exe PID 4036 wrote to memory of 1420 4036 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe reg.exe PID 4036 wrote to memory of 1420 4036 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe reg.exe PID 4036 wrote to memory of 3816 4036 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe cmd.exe PID 4036 wrote to memory of 3816 4036 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe cmd.exe PID 4036 wrote to memory of 3816 4036 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe cmd.exe PID 3816 wrote to memory of 1784 3816 cmd.exe cscript.exe PID 3816 wrote to memory of 1784 3816 cmd.exe cscript.exe PID 3816 wrote to memory of 1784 3816 cmd.exe cscript.exe PID 3516 wrote to memory of 3848 3516 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe cmd.exe PID 3516 wrote to memory of 3848 3516 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe cmd.exe PID 3516 wrote to memory of 3848 3516 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe cmd.exe PID 3848 wrote to memory of 2720 3848 cmd.exe 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe PID 3848 wrote to memory of 2720 3848 cmd.exe 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe PID 3848 wrote to memory of 2720 3848 cmd.exe 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe PID 3516 wrote to memory of 1620 3516 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe reg.exe PID 3516 wrote to memory of 1620 3516 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe reg.exe PID 3516 wrote to memory of 1620 3516 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe reg.exe PID 3516 wrote to memory of 1228 3516 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe reg.exe PID 3516 wrote to memory of 1228 3516 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe reg.exe PID 3516 wrote to memory of 1228 3516 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe reg.exe PID 3516 wrote to memory of 3592 3516 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe reg.exe PID 3516 wrote to memory of 3592 3516 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe reg.exe PID 3516 wrote to memory of 3592 3516 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe reg.exe PID 3516 wrote to memory of 3828 3516 60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\SSUksUcM\jIkooUIU.exe"C:\Users\Admin\SSUksUcM\jIkooUIU.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\ProgramData\pkkEQMMI\UMEwkUQU.exe"C:\ProgramData\pkkEQMMI\UMEwkUQU.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"8⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"10⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"12⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"14⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"16⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"18⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"20⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"22⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"24⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"26⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV127⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"28⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV129⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"30⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"32⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"34⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"36⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"38⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"40⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"42⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"44⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"46⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"48⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"50⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV151⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"52⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"54⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"56⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"58⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"60⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"62⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV163⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"64⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"66⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"68⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"70⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics71⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"72⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics73⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"74⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"76⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics77⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"78⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics79⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"80⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics81⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"82⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics83⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"84⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics85⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"86⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics87⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"88⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics89⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"90⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"92⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics93⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"94⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics95⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"96⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics97⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"98⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics99⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"100⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics101⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"102⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics103⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"104⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics105⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"106⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics107⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"108⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics109⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"110⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics111⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"112⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics113⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"114⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics115⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"116⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics117⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"118⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics119⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"120⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics121⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"122⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics123⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"124⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics125⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"126⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics127⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"128⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics129⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"130⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics131⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"132⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics133⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"134⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics135⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"136⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics137⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"138⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics139⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"140⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics141⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"142⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics143⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"144⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics145⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"146⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics147⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"148⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics149⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"150⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics151⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"152⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics153⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"154⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics155⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"156⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics157⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"158⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics159⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"160⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics161⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"162⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics163⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"164⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics165⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"166⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics167⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"168⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics169⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"170⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics171⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"172⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics173⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"174⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics175⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"176⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics177⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"178⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics179⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"180⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics181⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"182⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics183⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"184⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics185⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"186⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics187⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"188⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics189⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"190⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics191⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"192⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics193⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"194⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics195⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"196⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics197⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"198⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics199⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"200⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics201⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"202⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics203⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"204⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics205⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"206⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics207⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"208⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics209⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"210⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics211⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"212⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics213⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"214⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics215⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"216⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics217⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"218⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics219⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"220⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics221⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"222⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics223⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"224⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics225⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"226⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics227⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"228⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics229⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"230⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics231⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"232⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics233⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"234⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1235⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics235⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"236⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics237⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"238⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics239⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics"240⤵
-
C:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\60e52e5583a2290d74f0eeb48d2fe6a0_NeikiAnalytics241⤵