Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13-06-2024 01:13
Static task
static1
Behavioral task
behavioral1
Sample
52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe
-
Size
202KB
-
MD5
52d8ab906cd51eedfd1355e474b17ff0
-
SHA1
1f7ec1ad19d702cb7dea3f0f88cde30e229bf74e
-
SHA256
9bc173433cf3f10f49da56f3549d7a995164a16b98009e1af072ab0e894efb96
-
SHA512
336eb0926d008b548a3fa742fed76256ac58aacbdc313fafea9678a059d0dc0286c5aa967ae118ed597513319df3236b04cdc14f46d44cfe31ee4f95a8cd1011
-
SSDEEP
6144:n9zla8wBIG+c9CsxAI9PNR7OuQHHh+LH:nlcveqQsGI9Psh8
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (53) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wckIMkwA.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\International\Geo\Nation wckIMkwA.exe -
Executes dropped EXE 2 IoCs
Processes:
wckIMkwA.exepcgAIMok.exepid process 1708 wckIMkwA.exe 2596 pcgAIMok.exe -
Loads dropped DLL 20 IoCs
Processes:
52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exewckIMkwA.exepid process 1676 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 1676 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 1676 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 1676 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
wckIMkwA.exepcgAIMok.exe52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\wckIMkwA.exe = "C:\\Users\\Admin\\IgIEoUEU\\wckIMkwA.exe" wckIMkwA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\pcgAIMok.exe = "C:\\ProgramData\\XaEwQkks\\pcgAIMok.exe" pcgAIMok.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\wckIMkwA.exe = "C:\\Users\\Admin\\IgIEoUEU\\wckIMkwA.exe" 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\pcgAIMok.exe = "C:\\ProgramData\\XaEwQkks\\pcgAIMok.exe" 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 1816 reg.exe 1368 reg.exe 748 reg.exe 1108 reg.exe 2684 reg.exe 1320 reg.exe 312 reg.exe 628 reg.exe 2336 reg.exe 2540 reg.exe 2832 reg.exe 2720 reg.exe 2792 reg.exe 760 reg.exe 1688 reg.exe 1648 reg.exe 2672 reg.exe 536 reg.exe 2064 reg.exe 1808 reg.exe 1184 reg.exe 1820 reg.exe 1968 reg.exe 2620 reg.exe 2592 reg.exe 300 reg.exe 2888 reg.exe 1576 reg.exe 848 reg.exe 2204 reg.exe 2512 reg.exe 2308 reg.exe 2652 reg.exe 2788 reg.exe 2996 reg.exe 908 reg.exe 2664 reg.exe 2260 reg.exe 272 reg.exe 1808 reg.exe 640 reg.exe 2464 reg.exe 1604 reg.exe 1388 reg.exe 2552 reg.exe 288 reg.exe 2860 reg.exe 2376 reg.exe 1048 reg.exe 2480 reg.exe 2624 reg.exe 2452 reg.exe 2660 reg.exe 1560 reg.exe 2988 reg.exe 692 reg.exe 2760 reg.exe 1020 reg.exe 3032 reg.exe 2544 reg.exe 844 reg.exe 292 reg.exe 2220 reg.exe 2688 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exepid process 1676 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 1676 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 2100 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 2100 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 2720 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 2720 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 320 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 320 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 2800 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 2800 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 2400 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 2400 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 2152 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 2152 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 2580 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 2580 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 2208 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 2208 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 2712 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 2712 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 380 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 380 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 1528 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 1528 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 2572 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 2572 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 1804 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 1804 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 1248 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 1248 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 2912 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 2912 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 1308 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 1308 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 852 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 852 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 2616 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 2616 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 3024 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 3024 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 2312 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 2312 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 1260 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 1260 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 1104 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 1104 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 1964 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 1964 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 2664 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 2664 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 308 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 308 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 1212 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 1212 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 2708 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 2708 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 636 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 636 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 1968 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 1968 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 1340 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 1340 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 872 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe 872 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
wckIMkwA.exepid process 1708 wckIMkwA.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
wckIMkwA.exepid process 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe 1708 wckIMkwA.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.execmd.execmd.exe52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.execmd.execmd.exedescription pid process target process PID 1676 wrote to memory of 1708 1676 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe wckIMkwA.exe PID 1676 wrote to memory of 1708 1676 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe wckIMkwA.exe PID 1676 wrote to memory of 1708 1676 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe wckIMkwA.exe PID 1676 wrote to memory of 1708 1676 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe wckIMkwA.exe PID 1676 wrote to memory of 2596 1676 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe pcgAIMok.exe PID 1676 wrote to memory of 2596 1676 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe pcgAIMok.exe PID 1676 wrote to memory of 2596 1676 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe pcgAIMok.exe PID 1676 wrote to memory of 2596 1676 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe pcgAIMok.exe PID 1676 wrote to memory of 2624 1676 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe cmd.exe PID 1676 wrote to memory of 2624 1676 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe cmd.exe PID 1676 wrote to memory of 2624 1676 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe cmd.exe PID 1676 wrote to memory of 2624 1676 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe cmd.exe PID 2624 wrote to memory of 2100 2624 cmd.exe 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe PID 2624 wrote to memory of 2100 2624 cmd.exe 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe PID 2624 wrote to memory of 2100 2624 cmd.exe 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe PID 2624 wrote to memory of 2100 2624 cmd.exe 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe PID 1676 wrote to memory of 2540 1676 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe reg.exe PID 1676 wrote to memory of 2540 1676 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe reg.exe PID 1676 wrote to memory of 2540 1676 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe reg.exe PID 1676 wrote to memory of 2540 1676 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe reg.exe PID 1676 wrote to memory of 2716 1676 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe reg.exe PID 1676 wrote to memory of 2716 1676 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe reg.exe PID 1676 wrote to memory of 2716 1676 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe reg.exe PID 1676 wrote to memory of 2716 1676 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe reg.exe PID 1676 wrote to memory of 2424 1676 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe reg.exe PID 1676 wrote to memory of 2424 1676 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe reg.exe PID 1676 wrote to memory of 2424 1676 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe reg.exe PID 1676 wrote to memory of 2424 1676 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe reg.exe PID 1676 wrote to memory of 2700 1676 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe cmd.exe PID 1676 wrote to memory of 2700 1676 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe cmd.exe PID 1676 wrote to memory of 2700 1676 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe cmd.exe PID 1676 wrote to memory of 2700 1676 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe cmd.exe PID 2700 wrote to memory of 2420 2700 cmd.exe cscript.exe PID 2700 wrote to memory of 2420 2700 cmd.exe cscript.exe PID 2700 wrote to memory of 2420 2700 cmd.exe cscript.exe PID 2700 wrote to memory of 2420 2700 cmd.exe cscript.exe PID 2100 wrote to memory of 2644 2100 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe cmd.exe PID 2100 wrote to memory of 2644 2100 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe cmd.exe PID 2100 wrote to memory of 2644 2100 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe cmd.exe PID 2100 wrote to memory of 2644 2100 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe cmd.exe PID 2644 wrote to memory of 2720 2644 cmd.exe 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe PID 2644 wrote to memory of 2720 2644 cmd.exe 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe PID 2644 wrote to memory of 2720 2644 cmd.exe 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe PID 2644 wrote to memory of 2720 2644 cmd.exe 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe PID 2100 wrote to memory of 2752 2100 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe reg.exe PID 2100 wrote to memory of 2752 2100 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe reg.exe PID 2100 wrote to memory of 2752 2100 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe reg.exe PID 2100 wrote to memory of 2752 2100 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe reg.exe PID 2100 wrote to memory of 2760 2100 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe reg.exe PID 2100 wrote to memory of 2760 2100 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe reg.exe PID 2100 wrote to memory of 2760 2100 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe reg.exe PID 2100 wrote to memory of 2760 2100 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe reg.exe PID 2100 wrote to memory of 2832 2100 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe reg.exe PID 2100 wrote to memory of 2832 2100 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe reg.exe PID 2100 wrote to memory of 2832 2100 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe reg.exe PID 2100 wrote to memory of 2832 2100 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe reg.exe PID 2100 wrote to memory of 1456 2100 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe cmd.exe PID 2100 wrote to memory of 1456 2100 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe cmd.exe PID 2100 wrote to memory of 1456 2100 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe cmd.exe PID 2100 wrote to memory of 1456 2100 52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe cmd.exe PID 1456 wrote to memory of 1788 1456 cmd.exe cscript.exe PID 1456 wrote to memory of 1788 1456 cmd.exe cscript.exe PID 1456 wrote to memory of 1788 1456 cmd.exe cscript.exe PID 1456 wrote to memory of 1788 1456 cmd.exe cscript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\IgIEoUEU\wckIMkwA.exe"C:\Users\Admin\IgIEoUEU\wckIMkwA.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\XaEwQkks\pcgAIMok.exe"C:\ProgramData\XaEwQkks\pcgAIMok.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"6⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"8⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"10⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"12⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"14⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"16⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"18⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"20⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"22⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"24⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"26⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"28⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"30⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"32⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"34⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics35⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"36⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics37⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"38⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics39⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"40⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics41⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"42⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics43⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"44⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics45⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"46⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics47⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"48⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics49⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"50⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics51⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"52⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics53⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"54⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics55⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"56⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics57⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"58⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics59⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"60⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics61⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"62⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics63⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"64⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics65⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"66⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics67⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"68⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics69⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"70⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics71⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"72⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics73⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"74⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics75⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"76⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics77⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"78⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics79⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"80⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics81⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"82⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics83⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"84⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics85⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"86⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics87⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"88⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics89⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"90⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics91⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"92⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics93⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"94⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics95⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"96⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics97⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"98⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics99⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"100⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics101⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"102⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics103⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"104⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics105⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"106⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics107⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"108⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics109⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"110⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics111⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"112⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics113⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"114⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics115⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"116⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics117⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"118⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics119⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"120⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics121⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"122⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics123⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"124⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics125⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"126⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics127⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"128⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics129⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"130⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics131⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"132⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics133⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"134⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics135⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"136⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics137⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"138⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics139⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"140⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics141⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"142⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics143⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"144⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics145⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"146⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics147⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"148⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics149⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"150⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics151⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"152⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics153⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"154⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics155⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"156⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics157⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"158⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics159⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"160⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics161⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"162⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics163⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"164⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics165⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"166⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics167⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"168⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics169⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"170⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics171⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"172⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics173⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"174⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics175⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"176⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics177⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"178⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics179⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"180⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics181⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"182⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics183⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"184⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics185⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"186⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics187⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"188⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics189⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"190⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics191⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"192⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics193⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"194⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics195⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"196⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics197⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"198⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics199⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"200⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics201⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"202⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics203⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"204⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics205⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"206⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics207⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"208⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics209⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"210⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics211⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"212⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics213⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"214⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics215⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"216⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics217⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"218⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics219⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"220⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics221⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"222⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics223⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"224⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics225⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"226⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics227⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"228⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics229⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"230⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics231⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"232⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics233⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"234⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics235⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"236⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics237⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"238⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics239⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics"240⤵
-
C:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\52d8ab906cd51eedfd1355e474b17ff0_NeikiAnalytics241⤵