Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 19:53
Static task
static1
Behavioral task
behavioral1
Sample
156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe
-
Size
268KB
-
MD5
156c0c82cc6ec79b5e510a32ffb4c320
-
SHA1
3fba51da6a341e3d4d75342de7bf0765e2fe5fed
-
SHA256
80363080de8ff10d5702532b3e1cb112b848f12cb21608fc4868cc2ae8a1303a
-
SHA512
8d636830f305bba2c35b863a8138ac946be8f1278344c22c207fc1bb25391d13024379e7cca98c4848831be54de2ad05432d1cbf725e408db4cee9a2a2e76b58
-
SSDEEP
6144:fI5amBA/dOi5QBF12xiBS8HP3MHlqngE:g5XB8D5QBF1fU8HfMFqgE
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (83) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Blocklisted process makes network request 2 IoCs
Processes:
flow pid process 27 4188 28 4188 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SGoEAQcg.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation SGoEAQcg.exe -
Executes dropped EXE 2 IoCs
Processes:
SGoEAQcg.exeigQEcQwQ.exepid process 3412 SGoEAQcg.exe 3176 igQEcQwQ.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeSGoEAQcg.exeigQEcQwQ.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SGoEAQcg.exe = "C:\\Users\\Admin\\JeoIgsMk\\SGoEAQcg.exe" 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\igQEcQwQ.exe = "C:\\ProgramData\\RaMcUYMA\\igQEcQwQ.exe" 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SGoEAQcg.exe = "C:\\Users\\Admin\\JeoIgsMk\\SGoEAQcg.exe" SGoEAQcg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\igQEcQwQ.exe = "C:\\ProgramData\\RaMcUYMA\\igQEcQwQ.exe" igQEcQwQ.exe -
Drops file in System32 directory 2 IoCs
Processes:
SGoEAQcg.exedescription ioc process File created C:\Windows\SysWOW64\shell32.dll.exe SGoEAQcg.exe File opened for modification C:\Windows\SysWOW64\shell32.dll.exe SGoEAQcg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 1124 reg.exe 2040 reg.exe 3004 2620 reg.exe 1124 reg.exe 4908 1660 5116 reg.exe 3696 4856 1272 reg.exe 1648 reg.exe 4712 reg.exe 1328 reg.exe 1392 reg.exe 3256 reg.exe 1352 reg.exe 2240 reg.exe 2792 reg.exe 4704 reg.exe 3516 reg.exe 4692 reg.exe 4580 reg.exe 1984 reg.exe 4332 1648 reg.exe 1396 reg.exe 2372 reg.exe 4616 reg.exe 4584 4172 reg.exe 100 reg.exe 3020 reg.exe 4996 reg.exe 660 reg.exe 4692 reg.exe 3964 reg.exe 1560 reg.exe 3532 reg.exe 1060 reg.exe 1824 reg.exe 2324 reg.exe 3948 reg.exe 5112 reg.exe 2396 844 reg.exe 732 reg.exe 2068 reg.exe 1204 4532 792 3300 reg.exe 5052 reg.exe 1912 reg.exe 2252 reg.exe 1828 reg.exe 3704 reg.exe 5044 reg.exe 100 reg.exe 4552 reg.exe 4400 reg.exe 3492 reg.exe 1124 reg.exe 4592 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exepid process 2356 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 2356 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 2356 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 2356 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 3492 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 3492 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 3492 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 3492 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 3980 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 3980 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 3980 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 3980 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 4400 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 4400 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 4400 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 4400 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 3532 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 3532 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 3532 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 3532 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 1216 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 1216 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 1216 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 1216 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 816 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 816 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 816 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 816 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 4496 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 4496 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 4496 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 4496 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 4584 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 4584 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 4584 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 4584 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 3960 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 3960 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 3960 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 3960 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 4624 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 4624 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 4624 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 4624 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 1324 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 1324 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 1324 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 1324 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 916 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 916 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 916 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 916 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 4960 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 4960 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 4960 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 4960 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 2356 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 2356 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 2356 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 2356 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 552 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 552 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 552 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe 552 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
SGoEAQcg.exepid process 3412 SGoEAQcg.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
SGoEAQcg.exepid process 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe 3412 SGoEAQcg.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.execmd.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.execmd.execmd.exe156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.execmd.execmd.exedescription pid process target process PID 2356 wrote to memory of 3412 2356 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe SGoEAQcg.exe PID 2356 wrote to memory of 3412 2356 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe SGoEAQcg.exe PID 2356 wrote to memory of 3412 2356 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe SGoEAQcg.exe PID 2356 wrote to memory of 3176 2356 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe igQEcQwQ.exe PID 2356 wrote to memory of 3176 2356 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe igQEcQwQ.exe PID 2356 wrote to memory of 3176 2356 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe igQEcQwQ.exe PID 2356 wrote to memory of 1464 2356 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe cmd.exe PID 2356 wrote to memory of 1464 2356 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe cmd.exe PID 2356 wrote to memory of 1464 2356 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe cmd.exe PID 1464 wrote to memory of 3492 1464 cmd.exe 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe PID 1464 wrote to memory of 3492 1464 cmd.exe 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe PID 1464 wrote to memory of 3492 1464 cmd.exe 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe PID 2356 wrote to memory of 1824 2356 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 2356 wrote to memory of 1824 2356 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 2356 wrote to memory of 1824 2356 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 2356 wrote to memory of 3720 2356 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 2356 wrote to memory of 3720 2356 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 2356 wrote to memory of 3720 2356 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 2356 wrote to memory of 3984 2356 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 2356 wrote to memory of 3984 2356 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 2356 wrote to memory of 3984 2356 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 2356 wrote to memory of 3948 2356 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe cmd.exe PID 2356 wrote to memory of 3948 2356 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe cmd.exe PID 2356 wrote to memory of 3948 2356 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe cmd.exe PID 3492 wrote to memory of 5068 3492 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe cmd.exe PID 3492 wrote to memory of 5068 3492 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe cmd.exe PID 3492 wrote to memory of 5068 3492 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe cmd.exe PID 3948 wrote to memory of 4996 3948 cmd.exe cscript.exe PID 3948 wrote to memory of 4996 3948 cmd.exe cscript.exe PID 3948 wrote to memory of 4996 3948 cmd.exe cscript.exe PID 5068 wrote to memory of 3980 5068 cmd.exe 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe PID 5068 wrote to memory of 3980 5068 cmd.exe 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe PID 5068 wrote to memory of 3980 5068 cmd.exe 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe PID 3492 wrote to memory of 3736 3492 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 3492 wrote to memory of 3736 3492 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 3492 wrote to memory of 3736 3492 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 3492 wrote to memory of 2924 3492 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 3492 wrote to memory of 2924 3492 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 3492 wrote to memory of 2924 3492 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 3492 wrote to memory of 3684 3492 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 3492 wrote to memory of 3684 3492 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 3492 wrote to memory of 3684 3492 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 3492 wrote to memory of 2576 3492 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe cmd.exe PID 3492 wrote to memory of 2576 3492 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe cmd.exe PID 3492 wrote to memory of 2576 3492 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe cmd.exe PID 3980 wrote to memory of 712 3980 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe cmd.exe PID 3980 wrote to memory of 712 3980 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe cmd.exe PID 3980 wrote to memory of 712 3980 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe cmd.exe PID 2576 wrote to memory of 4840 2576 cmd.exe cscript.exe PID 2576 wrote to memory of 4840 2576 cmd.exe cscript.exe PID 2576 wrote to memory of 4840 2576 cmd.exe cscript.exe PID 712 wrote to memory of 4400 712 cmd.exe reg.exe PID 712 wrote to memory of 4400 712 cmd.exe reg.exe PID 712 wrote to memory of 4400 712 cmd.exe reg.exe PID 3980 wrote to memory of 1408 3980 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 3980 wrote to memory of 1408 3980 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 3980 wrote to memory of 1408 3980 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 3980 wrote to memory of 2532 3980 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 3980 wrote to memory of 2532 3980 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 3980 wrote to memory of 2532 3980 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 3980 wrote to memory of 1256 3980 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 3980 wrote to memory of 1256 3980 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 3980 wrote to memory of 1256 3980 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe reg.exe PID 3980 wrote to memory of 1156 3980 156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\JeoIgsMk\SGoEAQcg.exe"C:\Users\Admin\JeoIgsMk\SGoEAQcg.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\RaMcUYMA\igQEcQwQ.exe"C:\ProgramData\RaMcUYMA\igQEcQwQ.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"8⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"10⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"12⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"14⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"16⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"18⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"20⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"22⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"24⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"26⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"28⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"30⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV131⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"32⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"34⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"36⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV137⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"38⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"40⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV141⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"42⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"44⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV145⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"46⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"48⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"50⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"52⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"54⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"56⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"58⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"60⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV161⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"62⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"64⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"66⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV167⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"68⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"70⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics71⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"72⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics73⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"74⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV175⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"76⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics77⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"78⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics79⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"80⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics81⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"82⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV183⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics83⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"84⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV185⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics85⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"86⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV187⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics87⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"88⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics89⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"90⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"92⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics93⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"94⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV195⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics95⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"96⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV197⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics97⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"98⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV199⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics99⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"100⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics101⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"102⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics103⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"104⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1105⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics105⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"106⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics107⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"108⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1109⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics109⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"110⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics111⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"112⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics113⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"114⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1115⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics115⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"116⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1117⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics117⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"118⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics119⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"120⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics121⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"122⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics123⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"124⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1125⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics125⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"126⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1127⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics127⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"128⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics129⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"130⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1131⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics131⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"132⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics133⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"134⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics135⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"136⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics137⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"138⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics139⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"140⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics141⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"142⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics143⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"144⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics145⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"146⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics147⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"148⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1149⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics149⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"150⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics151⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"152⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics153⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"154⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics155⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"156⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics157⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"158⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics159⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"160⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1161⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics161⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"162⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics163⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"164⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics165⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"166⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics167⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"168⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1169⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics169⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"170⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics171⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"172⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics173⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"174⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics175⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"176⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics177⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"178⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1179⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics179⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"180⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics181⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"182⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics183⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"184⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics185⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"186⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1187⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics187⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"188⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics189⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"190⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1191⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics191⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"192⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics193⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"194⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics195⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"196⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics197⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"198⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics199⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"200⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics201⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"202⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1203⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics203⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"204⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics205⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"206⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics207⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"208⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics209⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"210⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics211⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"212⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics213⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"214⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics215⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"216⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics217⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"218⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1219⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics219⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"220⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics221⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"222⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics223⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"224⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics225⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"226⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics227⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"228⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1229⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics229⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"230⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics231⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"232⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics233⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"234⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics235⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"236⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics237⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"238⤵
-
C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics239⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\156c0c82cc6ec79b5e510a32ffb4c320_NeikiAnalytics"240⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1241⤵