Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 19:53
Static task
static1
Behavioral task
behavioral1
Sample
156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe
-
Size
268KB
-
MD5
156c0c82cc6ec79b5e510a32ffb4c320
-
SHA1
3fba51da6a341e3d4d75342de7bf0765e2fe5fed
-
SHA256
80363080de8ff10d5702532b3e1cb112b848f12cb21608fc4868cc2ae8a1303a
-
SHA512
8d636830f305bba2c35b863a8138ac946be8f1278344c22c207fc1bb25391d13024379e7cca98c4848831be54de2ad05432d1cbf725e408db4cee9a2a2e76b58
-
SSDEEP
6144:fI5amBA/dOi5QBF12xiBS8HP3MHlqngE:g5XB8D5QBF1fU8HfMFqgE
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (57) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
OgcwAwEU.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\International\Geo\Nation OgcwAwEU.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1608 cmd.exe -
Executes dropped EXE 2 IoCs
Processes:
OgcwAwEU.exezQMUIgwQ.exepid process 2128 OgcwAwEU.exe 2692 zQMUIgwQ.exe -
Loads dropped DLL 20 IoCs
Processes:
156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeOgcwAwEU.exepid process 2252 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 2252 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 2252 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 2252 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
zQMUIgwQ.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeOgcwAwEU.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zQMUIgwQ.exe = "C:\\ProgramData\\rCQcgYMA\\zQMUIgwQ.exe" zQMUIgwQ.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiUAkssw.exe = "C:\\Users\\Admin\\SSsAUQIk\\jiUAkssw.exe" 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kkkIogQU.exe = "C:\\ProgramData\\ViAssEMI\\kkkIogQU.exe" 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\OgcwAwEU.exe = "C:\\Users\\Admin\\dYkMwEok\\OgcwAwEU.exe" 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zQMUIgwQ.exe = "C:\\ProgramData\\rCQcgYMA\\zQMUIgwQ.exe" 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\OgcwAwEU.exe = "C:\\Users\\Admin\\dYkMwEok\\OgcwAwEU.exe" OgcwAwEU.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2716 1540 WerFault.exe kkkIogQU.exe 2252 2020 WerFault.exe jiUAkssw.exe -
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 2960 reg.exe 1556 reg.exe 1416 reg.exe 2060 reg.exe 1440 reg.exe 1348 reg.exe 2036 reg.exe 2172 reg.exe 2792 reg.exe 804 reg.exe 1940 reg.exe 1112 reg.exe 2504 reg.exe 2280 reg.exe 2856 reg.exe 1616 reg.exe 1740 reg.exe 2576 reg.exe 1924 reg.exe 1572 reg.exe 1252 reg.exe 548 reg.exe 1144 reg.exe 1312 reg.exe 2920 reg.exe 2708 reg.exe 2548 reg.exe 928 reg.exe 2992 reg.exe 1428 reg.exe 2712 reg.exe 2292 reg.exe 2904 reg.exe 1516 reg.exe 928 reg.exe 2548 reg.exe 1448 reg.exe 2960 reg.exe 2136 reg.exe 2136 reg.exe 1496 reg.exe 2404 reg.exe 2184 reg.exe 1960 reg.exe 1896 reg.exe 2336 reg.exe 952 reg.exe 2916 reg.exe 2032 reg.exe 2052 reg.exe 2512 reg.exe 2528 reg.exe 2764 reg.exe 660 reg.exe 2684 reg.exe 1900 reg.exe 660 reg.exe 1560 reg.exe 1132 reg.exe 1640 reg.exe 2380 reg.exe 808 reg.exe 1800 reg.exe 2484 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exepid process 2252 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 2252 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 2724 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 2724 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 2592 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 2592 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 448 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 448 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 2836 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 2836 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 1764 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 1764 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 1868 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 1868 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 2512 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 2512 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 1616 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 1616 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 1460 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 1460 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 1144 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 1144 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 2836 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 2836 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 1536 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 1536 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 2912 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 2912 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 2448 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 2448 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 1588 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 1588 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 2772 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 2772 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 2372 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 2372 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 1592 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 1592 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 2396 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 2396 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 488 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 488 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 1796 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 1796 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 1588 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 1588 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 2984 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 2984 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 1924 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 1924 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 2964 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 2964 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 1912 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 1912 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 2924 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 2924 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 2496 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 2496 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 892 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 892 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 1684 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 1684 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 1216 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 1216 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
OgcwAwEU.exepid process 2128 OgcwAwEU.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
OgcwAwEU.exepid process 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe 2128 OgcwAwEU.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.execmd.execmd.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.execmd.execmd.exedescription pid process target process PID 2252 wrote to memory of 2128 2252 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe OgcwAwEU.exe PID 2252 wrote to memory of 2128 2252 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe OgcwAwEU.exe PID 2252 wrote to memory of 2128 2252 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe OgcwAwEU.exe PID 2252 wrote to memory of 2128 2252 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe OgcwAwEU.exe PID 2252 wrote to memory of 2692 2252 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe zQMUIgwQ.exe PID 2252 wrote to memory of 2692 2252 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe zQMUIgwQ.exe PID 2252 wrote to memory of 2692 2252 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe zQMUIgwQ.exe PID 2252 wrote to memory of 2692 2252 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe zQMUIgwQ.exe PID 2252 wrote to memory of 2516 2252 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe cmd.exe PID 2252 wrote to memory of 2516 2252 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe cmd.exe PID 2252 wrote to memory of 2516 2252 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe cmd.exe PID 2252 wrote to memory of 2516 2252 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe cmd.exe PID 2252 wrote to memory of 2656 2252 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 2252 wrote to memory of 2656 2252 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 2252 wrote to memory of 2656 2252 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 2252 wrote to memory of 2656 2252 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 2516 wrote to memory of 2724 2516 cmd.exe 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe PID 2516 wrote to memory of 2724 2516 cmd.exe 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe PID 2516 wrote to memory of 2724 2516 cmd.exe 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe PID 2516 wrote to memory of 2724 2516 cmd.exe 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe PID 2252 wrote to memory of 2744 2252 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 2252 wrote to memory of 2744 2252 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 2252 wrote to memory of 2744 2252 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 2252 wrote to memory of 2744 2252 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 2252 wrote to memory of 2768 2252 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 2252 wrote to memory of 2768 2252 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 2252 wrote to memory of 2768 2252 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 2252 wrote to memory of 2768 2252 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 2252 wrote to memory of 2652 2252 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe cmd.exe PID 2252 wrote to memory of 2652 2252 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe cmd.exe PID 2252 wrote to memory of 2652 2252 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe cmd.exe PID 2252 wrote to memory of 2652 2252 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe cmd.exe PID 2652 wrote to memory of 2960 2652 cmd.exe cscript.exe PID 2652 wrote to memory of 2960 2652 cmd.exe cscript.exe PID 2652 wrote to memory of 2960 2652 cmd.exe cscript.exe PID 2652 wrote to memory of 2960 2652 cmd.exe cscript.exe PID 2724 wrote to memory of 2740 2724 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe cmd.exe PID 2724 wrote to memory of 2740 2724 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe cmd.exe PID 2724 wrote to memory of 2740 2724 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe cmd.exe PID 2724 wrote to memory of 2740 2724 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe cmd.exe PID 2740 wrote to memory of 2592 2740 cmd.exe 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe PID 2740 wrote to memory of 2592 2740 cmd.exe 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe PID 2740 wrote to memory of 2592 2740 cmd.exe 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe PID 2740 wrote to memory of 2592 2740 cmd.exe 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe PID 2724 wrote to memory of 2780 2724 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 2724 wrote to memory of 2780 2724 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 2724 wrote to memory of 2780 2724 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 2724 wrote to memory of 2780 2724 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 2724 wrote to memory of 108 2724 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 2724 wrote to memory of 108 2724 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 2724 wrote to memory of 108 2724 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 2724 wrote to memory of 108 2724 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 2724 wrote to memory of 1648 2724 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 2724 wrote to memory of 1648 2724 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 2724 wrote to memory of 1648 2724 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 2724 wrote to memory of 1648 2724 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 2724 wrote to memory of 2196 2724 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe cmd.exe PID 2724 wrote to memory of 2196 2724 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe cmd.exe PID 2724 wrote to memory of 2196 2724 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe cmd.exe PID 2724 wrote to memory of 2196 2724 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe cmd.exe PID 2196 wrote to memory of 380 2196 cmd.exe cscript.exe PID 2196 wrote to memory of 380 2196 cmd.exe cscript.exe PID 2196 wrote to memory of 380 2196 cmd.exe cscript.exe PID 2196 wrote to memory of 380 2196 cmd.exe cscript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\dYkMwEok\OgcwAwEU.exe"C:\Users\Admin\dYkMwEok\OgcwAwEU.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\rCQcgYMA\zQMUIgwQ.exe"C:\ProgramData\rCQcgYMA\zQMUIgwQ.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"6⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"8⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"10⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"12⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"14⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"16⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"18⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"20⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"22⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"24⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"26⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"28⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"30⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"32⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"34⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics35⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"36⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics37⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"38⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics39⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"40⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics41⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"42⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics43⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"44⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics45⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"46⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics47⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"48⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics49⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"50⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics51⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"52⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics53⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"54⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics55⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"56⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics57⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"58⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics59⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"60⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics61⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"62⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics63⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"64⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics65⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"66⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics67⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"68⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics69⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"70⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics71⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"72⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics73⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"74⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics75⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"76⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics77⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"78⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics79⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"80⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics81⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"82⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics83⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"84⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics85⤵
- Adds Run key to start application
-
C:\Users\Admin\SSsAUQIk\jiUAkssw.exe"C:\Users\Admin\SSsAUQIk\jiUAkssw.exe"86⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 3687⤵
- Program crash
-
C:\ProgramData\ViAssEMI\kkkIogQU.exe"C:\ProgramData\ViAssEMI\kkkIogQU.exe"86⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 3687⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"86⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics87⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"88⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics89⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"90⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics91⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"92⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics93⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"94⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics95⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"96⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics97⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"98⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics99⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"100⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics101⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"102⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics103⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"104⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics105⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"106⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics107⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"108⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics109⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"110⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics111⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"112⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics113⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"114⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics115⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"116⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics117⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"118⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics119⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"120⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics121⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"122⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics123⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"124⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics125⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"126⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics127⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"128⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics129⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"130⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics131⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"132⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics133⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"134⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics135⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"136⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics137⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"138⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics139⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"140⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics141⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"142⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics143⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"144⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics145⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"146⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics147⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"148⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics149⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"150⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics151⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"152⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics153⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"154⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics155⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"156⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics157⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"158⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics159⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"160⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics161⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"162⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics163⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"164⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics165⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"166⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics167⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"168⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics169⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"170⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics171⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"172⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics173⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"174⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics175⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"176⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics177⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"178⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics179⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"180⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics181⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"182⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics183⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"184⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics185⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"186⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics187⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"188⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics189⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"190⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics191⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"192⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics193⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"194⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics195⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"196⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics197⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"198⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics199⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"200⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics201⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"202⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics203⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"204⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics205⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"206⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics207⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"208⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics209⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"210⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics211⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"212⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics213⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"214⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics215⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"216⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics217⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"218⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics219⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"220⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics221⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"222⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics223⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"224⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics225⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"226⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics227⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"228⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics229⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"230⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics231⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"232⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics233⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"234⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics235⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"236⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics237⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"238⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics239⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"240⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics241⤵