Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
9s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 22:14
Static task
static1
Behavioral task
behavioral1
Sample
17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe
-
Size
323KB
-
MD5
17635e63d3b7a5679e82e95ed4ddc730
-
SHA1
1409e37a628a88bbe5b1c9602ed4d37081b7dead
-
SHA256
eb672217fcc214bdc80ac7965cba66bf314d67432db037017767248a3ffeabf4
-
SHA512
ac9e1aed3ab59565ebe06bcfd6f59880baae7ae49446943040592d9ae6e60e2f97ad994d4dcf86dc7e217c2b2bb15e4e23d76464d5d63563651652e4ed984471
-
SSDEEP
6144:aDOxZXrSHXUTsYkUehmgqcsnH59iAoyjaRsua7ZinXUGd8heLr00/gFAtrFtZraq:lXa8sYkUehmgBs3doQa+n7ZiXUJhX0aw
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 8 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File opened (read-only) \??\T: 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File opened (read-only) \??\U: 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File opened (read-only) \??\X: 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File opened (read-only) \??\Y: 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File opened (read-only) \??\B: 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File opened (read-only) \??\L: 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File opened (read-only) \??\O: 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File opened (read-only) \??\G: 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File opened (read-only) \??\H: 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File opened (read-only) \??\P: 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File opened (read-only) \??\M: 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File opened (read-only) \??\R: 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File opened (read-only) \??\V: 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File opened (read-only) \??\W: 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File opened (read-only) \??\A: 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File opened (read-only) \??\J: 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File opened (read-only) \??\K: 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File opened (read-only) \??\S: 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File opened (read-only) \??\Z: 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File opened (read-only) \??\E: 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File opened (read-only) \??\I: 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File opened (read-only) \??\N: 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\african gay [bangbus] swallow (Tatjana,Britney).rar.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Windows\SysWOW64\config\systemprofile\canadian cum masturbation cock sweet .mpeg.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Windows\System32\DriverStore\Temp\french trambling girls ¼ë (Melissa,Gina).mpg.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Windows\SysWOW64\FxsTmp\black gang bang xxx girls shoes .mpg.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Windows\SysWOW64\IME\SHARED\black fucking blowjob [free] balls .mpg.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\swedish fetish beastiality public lady .avi.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\spanish gang bang [milf] hole ash (Curtney).avi.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe -
Drops file in Program Files directory 19 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\Updates\Download\horse horse licking latex .zip.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\animal fetish [bangbus] ash .rar.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Program Files (x86)\Google\Temp\american beastiality hardcore masturbation sm .zip.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Program Files (x86)\Microsoft\Temp\horse horse several models .rar.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\kicking lesbian .mpg.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\black lingerie [free] wifey .zip.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Program Files (x86)\Google\Update\Download\japanese handjob [free] shower (Samantha,Sonja).mpg.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\norwegian blowjob sleeping blondie (Curtney).avi.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\brasilian horse hardcore uncut .rar.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\italian nude hardcore uncut (Britney).avi.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\cumshot nude [milf] vagina redhair .mpg.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\asian beast several models cock beautyfull .rar.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Program Files (x86)\Microsoft\Temp\EUB476.tmp\black animal hardcore [milf] .rar.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\beast public femdom .rar.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Templates\brasilian fetish girls .rar.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\spanish porn horse [bangbus] glans .zip.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\fetish horse several models glans .rar.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\spanish lingerie girls .zip.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\indian xxx hot (!) YEâPSè& (Gina,Karin).avi.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe -
Drops file in Windows directory 24 IoCs
description ioc Process File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\french horse fucking hidden (Curtney,Samantha).rar.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\gay beastiality hidden .mpg.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Windows\CbsTemp\african lingerie horse full movie (Anniston).mpeg.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Windows\InputMethod\SHARED\hardcore beastiality voyeur YEâPSè& .avi.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Windows\PLA\Templates\cum lesbian high heels .mpeg.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\fucking lesbian (Janette).mpeg.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\indian action full movie .zip.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\sperm [bangbus] (Samantha,Britney).rar.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\tyrkish gay fucking voyeur .zip.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\brasilian animal kicking [bangbus] cock (Jenna).rar.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\lingerie public 40+ .mpeg.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\gay [bangbus] cock .zip.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Windows\SoftwareDistribution\Download\blowjob cumshot uncut ash black hairunshaved .mpeg.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Windows\assembly\tmp\lingerie handjob girls .avi.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\hardcore several models mature .avi.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\tyrkish xxx horse catfight legs shoes (Kathrin).mpeg.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Windows\security\templates\fucking licking .mpg.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Windows\SoftwareDistribution\Download\SharedFileCache\black beast xxx hot (!) .mpeg.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Windows\mssrv.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\canadian sperm lingerie big .avi.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Windows\assembly\temp\canadian lesbian sperm licking shoes (Sonja).mpeg.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Windows\Downloaded Program Files\german beastiality hardcore hidden .mpg.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\bukkake beastiality girls (Janette).rar.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\gang bang catfight .zip.exe 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 4392 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 4392 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 1596 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 1596 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 4392 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 4392 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 4476 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 4476 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 4392 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 4392 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 1512 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 1512 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 1596 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 1596 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 4832 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 4832 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 3900 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 4392 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 4392 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 3900 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 1596 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 1596 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 4360 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 4360 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 4476 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 4476 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 2636 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 2636 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 1512 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 1512 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 4392 wrote to memory of 1596 4392 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 88 PID 4392 wrote to memory of 1596 4392 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 88 PID 4392 wrote to memory of 1596 4392 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 88 PID 1596 wrote to memory of 1512 1596 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 89 PID 1596 wrote to memory of 1512 1596 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 89 PID 1596 wrote to memory of 1512 1596 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 89 PID 4392 wrote to memory of 4476 4392 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 90 PID 4392 wrote to memory of 4476 4392 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 90 PID 4392 wrote to memory of 4476 4392 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 90 PID 4392 wrote to memory of 4832 4392 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 91 PID 4392 wrote to memory of 4832 4392 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 91 PID 4392 wrote to memory of 4832 4392 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 91 PID 1596 wrote to memory of 3900 1596 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 92 PID 1596 wrote to memory of 3900 1596 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 92 PID 1596 wrote to memory of 3900 1596 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 92 PID 4476 wrote to memory of 4360 4476 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 93 PID 4476 wrote to memory of 4360 4476 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 93 PID 4476 wrote to memory of 4360 4476 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 93 PID 1512 wrote to memory of 2636 1512 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 94 PID 1512 wrote to memory of 2636 1512 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 94 PID 1512 wrote to memory of 2636 1512 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 94 PID 4392 wrote to memory of 2968 4392 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 95 PID 4392 wrote to memory of 2968 4392 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 95 PID 4392 wrote to memory of 2968 4392 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 95 PID 1596 wrote to memory of 1812 1596 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 96 PID 1596 wrote to memory of 1812 1596 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 96 PID 1596 wrote to memory of 1812 1596 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 96 PID 4832 wrote to memory of 4380 4832 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 97 PID 4832 wrote to memory of 4380 4832 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 97 PID 4832 wrote to memory of 4380 4832 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 97 PID 4476 wrote to memory of 3400 4476 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 98 PID 4476 wrote to memory of 3400 4476 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 98 PID 4476 wrote to memory of 3400 4476 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 98 PID 1512 wrote to memory of 608 1512 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 99 PID 1512 wrote to memory of 608 1512 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 99 PID 1512 wrote to memory of 608 1512 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 99 PID 3900 wrote to memory of 3564 3900 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 100 PID 3900 wrote to memory of 3564 3900 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 100 PID 3900 wrote to memory of 3564 3900 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 100 PID 4360 wrote to memory of 2220 4360 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 101 PID 4360 wrote to memory of 2220 4360 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 101 PID 4360 wrote to memory of 2220 4360 17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"3⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"6⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"7⤵PID:6216
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"8⤵PID:10068
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"8⤵PID:13796
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"7⤵PID:7716
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"7⤵PID:10284
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"7⤵PID:14400
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"6⤵PID:6096
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"7⤵PID:11132
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"6⤵PID:7252
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"6⤵PID:9548
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"6⤵PID:13116
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"6⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"7⤵PID:11196
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"6⤵PID:7648
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"6⤵PID:10208
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"6⤵PID:14136
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:5732
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"6⤵PID:9556
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"6⤵PID:13100
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:7312
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:9640
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:13228
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:608
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"6⤵PID:6168
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"7⤵PID:11140
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"6⤵PID:7804
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"6⤵PID:9656
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"6⤵PID:13888
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:5980
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"6⤵PID:9592
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"6⤵PID:13092
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:7304
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:9612
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:13176
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:5816
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"6⤵PID:10024
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"6⤵PID:13724
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:6912
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"6⤵PID:13480
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:9368
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:12772
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:5452
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:9000
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:11936
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:6640
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:11924
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:8364
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:348
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"3⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"6⤵PID:5960
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"7⤵PID:11212
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"6⤵PID:7624
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"6⤵PID:10116
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"6⤵PID:13812
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:5824
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"6⤵PID:9872
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"6⤵PID:13372
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:7296
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:9632
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:13184
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:6076
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"6⤵PID:10548
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"6⤵PID:14488
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:7260
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:9540
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:13124
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:5504
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:9012
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:12308
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:6752
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:12840
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:9160
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:12612
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"3⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:5972
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"6⤵PID:10076
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"6⤵PID:14120
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:7380
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"6⤵PID:14716
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:10012
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:13504
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:5600
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:9116
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:12704
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:7016
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:14144
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:8796
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:12720
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"3⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:5200
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:6728
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"6⤵PID:12832
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:9180
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:12492
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:6436
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:11940
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:7984
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:10924
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:14360
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"3⤵PID:5168
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:7068
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:13488
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:9236
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:12712
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"3⤵PID:6344
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:10956
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"3⤵PID:8168
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"3⤵PID:10840
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"3⤵PID:15096
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"3⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"6⤵PID:6152
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"7⤵PID:10472
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"6⤵PID:7640
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"6⤵PID:9708
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"6⤵PID:14320
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:5832
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"6⤵PID:10556
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"6⤵PID:11736
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:7280
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:9608
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:12460
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:5232
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"6⤵PID:10200
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"6⤵PID:13988
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:7340
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"6⤵PID:14468
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:9624
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:13192
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:5496
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:8976
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:12068
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:6764
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:12824
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:9152
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:12472
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"3⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:6160
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"6⤵PID:10312
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"6⤵PID:12860
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:7632
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:10500
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:14452
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:5760
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:10672
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:15132
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:7288
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:9600
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:13220
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"3⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:5608
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:9292
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:12764
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:6996
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:12904
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:8720
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:12660
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"3⤵PID:5336
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:7388
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:10044
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:13980
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"3⤵PID:6564
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:12756
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"3⤵PID:8668
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"3⤵PID:11872
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"3⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:6052
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"6⤵PID:10292
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"6⤵PID:14328
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:7812
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:9676
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:14160
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:5740
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:10036
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:13804
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:7320
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:9796
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:13236
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"3⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:5296
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:7616
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:9672
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:14476
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:6516
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:12180
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:7524
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:10780
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:14896
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"3⤵PID:5268
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:8536
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:11772
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"3⤵PID:6420
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:12008
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"3⤵PID:8268
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"3⤵PID:11204
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"2⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"3⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:6088
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:10740
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:7528
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:10108
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:13996
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"3⤵PID:5352
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:8496
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:11340
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"3⤵PID:6576
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:12328
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"3⤵PID:8572
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"3⤵PID:11512
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"2⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"3⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:7008
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"5⤵PID:13132
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:8636
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:12620
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"3⤵PID:6384
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:12240
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"3⤵PID:8304
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"3⤵PID:10608
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"2⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"3⤵PID:7028
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"4⤵PID:13696
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"3⤵PID:9256
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"3⤵PID:12748
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"2⤵PID:6392
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"3⤵PID:12260
-
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"2⤵PID:7688
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"2⤵PID:10916
-
-
C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17635e63d3b7a5679e82e95ed4ddc730_NeikiAnalytics.exe"2⤵PID:12936
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\spanish porn horse [bangbus] glans .zip.exe
Filesize513KB
MD580100720e8b940e29863b89ed7ae83b4
SHA1998047773a98b1fedd9a06e0efd560b15f51a8a8
SHA256f80e55dc4ecb0138f677b769a12e6c23b226c2b70d298b622ccc5596a2aa9e7d
SHA512fdf772a4150e1f080ea143da6e4909dcfbf8f85da4d7bb8d27892334a6b22f9f69703dac56c163c1bd7e993aebc3a05574ab1966efd3d4af22c93e9a6ea3771c