Analysis
-
max time kernel
15s -
max time network
65s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07/05/2024, 22:59
Behavioral task
behavioral1
Sample
5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe
Resource
win10v2004-20240419-en
General
-
Target
5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe
-
Size
1.3MB
-
MD5
5b7bfdb55231478f71a4d0f5f2a7d930
-
SHA1
aec602dd4bedbe4151ff6407d307c6d2ce62bb14
-
SHA256
4d49f85d8c29856fdeaa9188e3532087f3f30b727570db794d2ee1b49ffaa9c0
-
SHA512
7334848aefe20cad56aefc9db0074e1d34cf7b6cc3264fbb3ee147e8985f4300561ee61a86258b5555d0b95322043e4887cf61a9a0feb5c03b9bf943ef10070b
-
SSDEEP
24576:0CzAsI5xOLFtvVp6FwO5z9TcM5s290rD/2nEEBSgc1SqVR3OGbjcBChq/0T1bTSp:vzyALz76FwMBTchy0rL2EAK1SyTvgmqN
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 16 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe Key value queried \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe Key value queried \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe Key value queried \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe Key value queried \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe Key value queried \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe Key value queried \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe Key value queried \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe Key value queried \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe Key value queried \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe Key value queried \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe Key value queried \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe Key value queried \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe Key value queried \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe Key value queried \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe Key value queried \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/2320-0-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/files/0x000a000000023b9f-5.dat upx behavioral2/memory/3780-25-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4648-176-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2356-185-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3400-188-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2184-187-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2320-186-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3780-189-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3548-191-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1652-190-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3632-192-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1324-194-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/964-193-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2320-195-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3636-197-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2768-196-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/388-198-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4648-201-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1200-200-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3328-199-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2356-202-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4192-204-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2528-203-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4448-207-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3400-206-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2184-205-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/464-209-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2520-208-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3084-212-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2156-211-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3548-210-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1324-213-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/5148-215-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/5172-218-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/5200-217-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3636-216-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1500-214-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1032-224-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1200-223-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3328-222-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4460-227-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/5364-226-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/5356-225-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/5420-231-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/5436-233-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/464-232-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3812-230-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4448-229-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4192-228-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/5428-234-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/5452-237-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/5444-236-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3160-235-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/5460-239-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3084-238-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/5148-242-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/5140-241-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1500-240-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/5344-245-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/5172-244-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/5200-243-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/6148-247-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/5348-246-0x0000000000400000-0x000000000041E000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File opened (read-only) \??\O: 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File opened (read-only) \??\P: 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File opened (read-only) \??\A: 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File opened (read-only) \??\B: 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File opened (read-only) \??\G: 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File opened (read-only) \??\H: 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File opened (read-only) \??\I: 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File opened (read-only) \??\S: 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File opened (read-only) \??\V: 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File opened (read-only) \??\K: 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File opened (read-only) \??\T: 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File opened (read-only) \??\U: 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File opened (read-only) \??\W: 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File opened (read-only) \??\X: 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File opened (read-only) \??\E: 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File opened (read-only) \??\N: 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File opened (read-only) \??\Y: 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File opened (read-only) \??\Z: 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File opened (read-only) \??\L: 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File opened (read-only) \??\M: 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File opened (read-only) \??\Q: 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File opened (read-only) \??\R: 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\Temp\danish kicking hardcore uncut penetration .mpeg.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\indian cum beast full movie girly .rar.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\japanese fetish sperm girls feet redhair (Tatjana).rar.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\gay several models .mpg.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\SysWOW64\IME\SHARED\american handjob trambling uncut leather (Anniston,Jade).mpg.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\danish gang bang beast voyeur glans granny (Curtney).mpeg.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\SysWOW64\config\systemprofile\lesbian lesbian ejaculation .mpg.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\SysWOW64\FxsTmp\sperm licking boots .mpg.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\SysWOW64\IME\SHARED\bukkake sleeping .zip.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\gay full movie .zip.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\SysWOW64\config\systemprofile\danish cumshot fucking [bangbus] cock .mpg.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\SysWOW64\FxsTmp\horse licking .mpeg.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe -
Drops file in Program Files directory 18 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\gay public (Karin).rar.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\japanese beastiality fucking catfight .rar.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\xxx full movie fishy .mpg.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\indian horse fucking [milf] gorgeoushorny .mpeg.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Program Files\Microsoft Office\Updates\Download\lesbian full movie sm (Ashley,Janette).avi.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\brasilian horse sperm licking YEâPSè& .avi.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Program Files\Microsoft Office\root\Templates\bukkake sleeping titts wifey (Jade).zip.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\russian nude trambling lesbian .mpeg.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\american kicking horse masturbation glans (Christine,Samantha).avi.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Program Files (x86)\Google\Update\Download\swedish beastiality beast masturbation (Sylvia).rar.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\lesbian big cock mistress (Sylvia).mpg.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Program Files (x86)\Microsoft\Temp\blowjob lesbian feet bondage .rar.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Program Files\Common Files\microsoft shared\sperm uncut Ôï .mpeg.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Program Files\dotnet\shared\danish beastiality horse full movie lady (Sonja,Melissa).rar.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\trambling [bangbus] hole .mpg.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\russian kicking beast sleeping glans .mpg.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Program Files (x86)\Google\Temp\swedish porn bukkake big glans black hairunshaved .rar.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\swedish gang bang bukkake voyeur cock shoes .mpeg.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SoftwareDistribution\Download\SharedFileCache\indian beastiality fucking [free] hairy .zip.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c3d467c525734eb3\norwegian lingerie licking young .rar.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_d38ece58f77171b4\british lesbian hidden .mpg.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.1_none_9aa486d790131d4e\action lesbian girls redhair .zip.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\mssrv.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\Downloaded Program Files\danish cum beast [free] hole latex (Sylvia).mpeg.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_it-it_bdb6c49fcea35732\gang bang hardcore [free] hole .rar.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_1bbb9ab9fc52bac9\swedish cum blowjob [bangbus] (Janette).mpg.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_de-de_16bd831fd16633be\lesbian catfight (Curtney).rar.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.572_none_cf90e12518baac85\canadian hardcore hot (!) cock 50+ (Curtney).avi.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.1266_none_7916f7558927ae23\african lesbian sleeping balls .rar.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\tyrkish horse hardcore hot (!) hole .rar.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\assembly\temp\beast licking granny (Sandy,Tatjana).avi.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5fdc43acc1be690d\lesbian girls (Sylvia).mpeg.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.844_none_67b5915b5651dd8a\animal trambling uncut shoes .rar.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.1_none_833abdc06c68d338\beastiality beast public sweet .mpg.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1288_none_ca3007304990b2ea\beastiality sperm catfight hole sweet .avi.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\japanese handjob blowjob voyeur circumcision .mpeg.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\PLA\Templates\russian horse xxx big latex .mpeg.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\templates\fucking full movie hole (Kathrin,Sylvia).rar.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\SystemResources\Windows.UI.ShellCommon\SharePickerUI\beast sleeping hole stockings .mpg.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.746_none_d01527cffa9c25bc\spanish lingerie girls ash .zip.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1_none_3cfd44d351b1a8ab\chinese lesbian uncut .mpeg.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_ab42fb092bda9182\danish cum blowjob masturbation feet fishy (Jade).mpg.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.1_none_a80cea873b2a6772\chinese sperm big .mpg.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_en-us_bfae5918c0443f83\french lesbian full movie bedroom .rar.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\brasilian horse gay [bangbus] feet .rar.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\tyrkish animal gay uncut wifey .rar.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_en-us_215194e2327a46ac\italian horse bukkake uncut leather .mpeg.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_adfc5e0bfca53431\american action horse several models cock swallow .mpg.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.1_none_0bc0f3d4cd7dc8fd\german hardcore [milf] Ôï .mpg.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_de-de_881b257d159a5de8\german trambling catfight hole bedroom (Melissa).avi.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\american cum lesbian [free] hole gorgeoushorny (Karin).rar.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.867_en-us_49453482f1fb5356\malaysia sperm full movie (Curtney).mpg.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_cb389cf57d74d691\french xxx [milf] glans (Jenna,Tatjana).rar.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_855aff45853749ef\french hardcore [bangbus] hole .mpeg.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\danish cumshot fucking uncut traffic .zip.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\SystemResources\Windows.ShellCommon.SharedResources\italian kicking lesbian girls cock castration .rar.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_19d22204a1f3fcaf\beast [milf] .zip.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1_none_0b596e2a33be7d4c\african horse big feet black hairunshaved .mpg.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\bukkake masturbation ash .avi.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\american horse fucking uncut (Liz).avi.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\WinSxS\amd64_microsoft-composable-sharepicker_31bf3856ad364e35_10.0.19041.1_none_c87e96327faffd0e\gay catfight (Samantha).mpg.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_f3b35d713ce0fc7f\black cumshot bukkake [bangbus] latex .rar.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_7860bee9439c3ae7\italian porn sperm [milf] high heels .mpeg.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.789_en-us_58ebf9ecc407e3c0\russian fetish hardcore uncut .mpg.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.1_none_5d54c0aac5c3c12c\asian horse masturbation hole stockings .rar.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-jkshared-roaming_31bf3856ad364e35_10.0.19041.1_none_fa09f84703cb02c5\beast hidden beautyfull (Sandy,Sarah).mpeg.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_ee7ea14f7d8a3ee3\black kicking blowjob big (Karin).rar.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\british blowjob sleeping bondage .zip.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\assembly\tmp\american gang bang hardcore lesbian (Curtney).mpeg.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\InputMethod\SHARED\italian handjob lingerie public (Sarah).zip.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_es-es_211cf1c632a13851\hardcore catfight .mpg.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5021dd18efc0460c\malaysia beast [free] .mpeg.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_en-us_310bfb76047869ad\action lesbian voyeur .mpg.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.844_none_57eddd48e7a74274\action beast [free] girly .zip.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-jkshared-roaming_31bf3856ad364e35_10.0.19041.746_none_2212358fc33cc10f\canadian fucking hot (!) YEâPSè& .avi.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_62312bfbb33d478a\japanese nude gay masturbation glans shoes .mpg.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1202_none_d8a1416ab7cccdcf\handjob bukkake big hairy .mpeg.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\CbsTemp\bukkake lesbian glans .mpg.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\beast girls (Tatjana).rar.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_es-es_30d7585a049f5b52\animal bukkake uncut (Liz).avi.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.1202_none_621728fcd3c9d5f6\asian blowjob several models feet YEâPSè& (Melissa).zip.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_f07d4fae3e8e883f\danish porn fucking [bangbus] titts .mpeg.exe 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2320 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 2320 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 3780 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 3780 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 2320 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 2320 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 1652 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 1652 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 3632 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 3632 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 2320 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 2320 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 3780 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 3780 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 964 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 964 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 2768 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 2768 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 3780 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 3780 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 2320 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 2320 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 388 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 388 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 1652 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 1652 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 4648 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 4648 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 3632 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 3632 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 2356 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 2356 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 964 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 964 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 2528 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 2528 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 2184 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 2184 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 3400 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 3400 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 3780 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 3780 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 1652 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 1652 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 2320 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 2320 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 3548 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 3548 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 2520 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 2520 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 3632 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 3632 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 2768 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 2768 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 2156 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 1324 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 2156 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 1324 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 388 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 388 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 4648 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 4648 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 3636 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 3636 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2320 wrote to memory of 3780 2320 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 86 PID 2320 wrote to memory of 3780 2320 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 86 PID 2320 wrote to memory of 3780 2320 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 86 PID 2320 wrote to memory of 1652 2320 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 91 PID 2320 wrote to memory of 1652 2320 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 91 PID 2320 wrote to memory of 1652 2320 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 91 PID 3780 wrote to memory of 3632 3780 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 92 PID 3780 wrote to memory of 3632 3780 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 92 PID 3780 wrote to memory of 3632 3780 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 92 PID 2320 wrote to memory of 964 2320 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 94 PID 2320 wrote to memory of 964 2320 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 94 PID 2320 wrote to memory of 964 2320 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 94 PID 3780 wrote to memory of 2768 3780 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 95 PID 3780 wrote to memory of 2768 3780 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 95 PID 3780 wrote to memory of 2768 3780 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 95 PID 1652 wrote to memory of 388 1652 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 96 PID 1652 wrote to memory of 388 1652 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 96 PID 1652 wrote to memory of 388 1652 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 96 PID 3632 wrote to memory of 4648 3632 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 97 PID 3632 wrote to memory of 4648 3632 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 97 PID 3632 wrote to memory of 4648 3632 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 97 PID 964 wrote to memory of 2356 964 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 102 PID 964 wrote to memory of 2356 964 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 102 PID 964 wrote to memory of 2356 964 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 102 PID 3780 wrote to memory of 2528 3780 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 103 PID 3780 wrote to memory of 2528 3780 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 103 PID 3780 wrote to memory of 2528 3780 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 103 PID 2320 wrote to memory of 2184 2320 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 104 PID 2320 wrote to memory of 2184 2320 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 104 PID 2320 wrote to memory of 2184 2320 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 104 PID 1652 wrote to memory of 3400 1652 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 105 PID 1652 wrote to memory of 3400 1652 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 105 PID 1652 wrote to memory of 3400 1652 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 105 PID 3632 wrote to memory of 2520 3632 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 106 PID 3632 wrote to memory of 2520 3632 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 106 PID 3632 wrote to memory of 2520 3632 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 106 PID 2768 wrote to memory of 3548 2768 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 107 PID 2768 wrote to memory of 3548 2768 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 107 PID 2768 wrote to memory of 3548 2768 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 107 PID 4648 wrote to memory of 2156 4648 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 108 PID 4648 wrote to memory of 2156 4648 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 108 PID 4648 wrote to memory of 2156 4648 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 108 PID 388 wrote to memory of 1324 388 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 109 PID 388 wrote to memory of 1324 388 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 109 PID 388 wrote to memory of 1324 388 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 109 PID 964 wrote to memory of 3636 964 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 112 PID 964 wrote to memory of 3636 964 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 112 PID 964 wrote to memory of 3636 964 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 112 PID 1652 wrote to memory of 3328 1652 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 114 PID 1652 wrote to memory of 3328 1652 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 114 PID 1652 wrote to memory of 3328 1652 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 114 PID 2356 wrote to memory of 1200 2356 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 113 PID 2356 wrote to memory of 1200 2356 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 113 PID 2356 wrote to memory of 1200 2356 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 113 PID 2320 wrote to memory of 1032 2320 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 115 PID 2320 wrote to memory of 1032 2320 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 115 PID 2320 wrote to memory of 1032 2320 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 115 PID 3780 wrote to memory of 4460 3780 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 116 PID 3780 wrote to memory of 4460 3780 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 116 PID 3780 wrote to memory of 4460 3780 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 116 PID 3632 wrote to memory of 4192 3632 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 118 PID 3632 wrote to memory of 4192 3632 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 118 PID 3632 wrote to memory of 4192 3632 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 118 PID 388 wrote to memory of 4448 388 5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"3⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:5200
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"7⤵PID:6156
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"8⤵PID:9396
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"8⤵PID:14380
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"7⤵PID:3544
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"7⤵PID:3456
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"7⤵PID:13864
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:5348
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"7⤵PID:8140
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"7⤵PID:10672
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"7⤵PID:14232
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:6688
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"7⤵PID:12312
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"7⤵PID:13920
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:7400
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:11952
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:13944
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:6164
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"7⤵PID:9388
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"7⤵PID:14432
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:7976
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:10844
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:14160
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:5396
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"7⤵PID:14280
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:8044
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:10712
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:14264
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:6808
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:14272
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:8108
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:10936
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:14152
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:5148
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:6484
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"7⤵PID:10436
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"7⤵PID:14248
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:8156
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:10960
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:14056
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:5364
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:6444
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"7⤵PID:14304
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:8028
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:2624
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:14080
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:6680
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:5092
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:7264
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:11288
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:14016
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:6172
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:8268
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:11784
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:13968
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:7180
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:11528
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:14000
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:5428
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:8904
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:11280
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:14048
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:7020
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:14716
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:8092
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:10832
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:14208
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"3⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:5140
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:6196
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"7⤵PID:9372
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"7⤵PID:14440
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:7972
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:10728
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:14216
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:5372
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:8188
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:11768
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:13848
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:6728
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:14328
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:8124
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:10560
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:14008
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:6228
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:8220
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:12112
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:13928
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:8172
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:11704
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:13936
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:5412
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:9464
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:14448
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:7040
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:14296
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:8076
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:10688
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:14200
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"3⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:6212
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:14372
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:7416
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:11736
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:13976
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:5380
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:6872
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:15928
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:7996
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:10928
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:14184
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:6792
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:13072
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:8100
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:11076
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:14192
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"3⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:6220
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:9420
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:14456
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:2996
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:11776
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:13960
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"3⤵PID:5436
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:8784
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:11260
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:14104
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"3⤵PID:7032
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:15348
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"3⤵PID:8084
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"3⤵PID:10944
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"3⤵PID:14144
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"3⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:5172
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:6204
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"7⤵PID:9412
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"7⤵PID:13872
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:8148
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:10976
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:14136
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:5356
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:7192
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"7⤵PID:14312
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:8012
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:11068
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:14176
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:6736
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:8132
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:11688
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:13896
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:6148
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:9364
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:14344
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:8180
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:10496
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:14088
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:5420
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:8256
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:11696
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:13984
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:7012
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:8060
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:10704
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:14256
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"3⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:6180
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:9356
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:13812
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:7964
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:10720
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:14224
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:5404
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:8896
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:10512
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:14072
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:6800
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:14288
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:8116
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:10824
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:14168
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"3⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:6188
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:9472
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:13840
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:3024
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:10968
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:14096
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"3⤵PID:5452
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:8976
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:11536
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:13992
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"3⤵PID:6632
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:14708
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"3⤵PID:8036
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"3⤵PID:11232
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"3⤵PID:13880
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"3⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:5344
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:9380
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:14464
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:7600
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"6⤵PID:14320
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:7988
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:10680
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:14240
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:5460
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:9404
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:14356
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:6560
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:3416
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:8020
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:10952
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:14112
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:6500
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:12560
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:13904
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:7272
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:164
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:14040
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"3⤵PID:5468
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:9456
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:13888
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"3⤵PID:6604
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:13816
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"3⤵PID:8004
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"3⤵PID:10984
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"3⤵PID:14128
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"3⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:6536
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:12284
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:13912
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:6464
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:11100
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"5⤵PID:17032
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:13856
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"3⤵PID:5388
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:8984
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:11680
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:13952
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"3⤵PID:7004
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:13832
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"3⤵PID:8068
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"3⤵PID:11224
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"3⤵PID:14064
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"2⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"3⤵PID:6092
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"4⤵PID:13824
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"3⤵PID:8164
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"3⤵PID:11272
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"3⤵PID:14032
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"2⤵PID:5444
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"3⤵PID:8548
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"3⤵PID:11296
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"3⤵PID:14024
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"2⤵PID:6476
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"3⤵PID:14364
-
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"2⤵PID:8052
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"2⤵PID:10992
-
-
C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5b7bfdb55231478f71a4d0f5f2a7d930_NEIKI.exe"2⤵PID:14120
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\trambling [bangbus] hole .mpg.exe
Filesize1.4MB
MD5b512e8575348d936547636ffb2438222
SHA1b49b7a1edebb090640280a64da99bf9c828de1a7
SHA2561781adf8fb799f880cfe941a9e6303367d3a876a28e35dad4f45077d2f3c3b94
SHA512d0643bcc88dbcdacca8cb1638def07f9dead503a96f257cb95958bb62836ca5595fdf862cbdb5c9e9d8fdb8418ff0a42c7dc312eacf49189b11e36e74eaf58ea