Analysis
-
max time kernel
17s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11-05-2024 02:26
Behavioral task
behavioral1
Sample
5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe
-
Size
1.7MB
-
MD5
5aa7aca0d734b0e9278ca98d8548b950
-
SHA1
198051bcb04a55a7bd894bdb63e1d0450d87a517
-
SHA256
4508aa15054f5157de783ae48b634b599878502c9b426260dda9ebb8519d9777
-
SHA512
9395a90652aa4919f3ea82d38f0612e1026980aa93b18b8b87962e87f7465343065f8d4ae858104f24c5257a74559de63a867ff85b89db116d585260b165e390
-
SSDEEP
49152:stbkpRWxdysBXHwY4pcQJ4DttMiiihIE3iFegBw8:seXyysBM6Z3dee6w8
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 16 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/4968-0-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/files/0x0007000000023426-5.dat upx behavioral2/memory/4016-75-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/380-160-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/3472-161-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1048-180-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2480-181-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1644-182-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/3132-183-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/932-186-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/3520-185-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1828-184-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/3928-188-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/3788-187-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4128-189-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4452-191-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4440-192-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4968-190-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/380-196-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/3944-195-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4016-194-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2480-202-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1048-201-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4692-200-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/436-199-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4084-198-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/3472-197-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1644-203-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4552-206-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4244-205-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/3048-204-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2820-209-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1148-208-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/3132-207-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1828-210-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/932-212-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/3788-213-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/3928-214-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/3520-211-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4632-215-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4440-216-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/3944-220-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4860-240-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/880-223-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1444-222-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1472-221-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/5104-239-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2224-246-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2820-238-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/776-245-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/724-237-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/3988-236-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4552-235-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4244-234-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/3048-233-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/936-244-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1892-243-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2052-232-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/3412-231-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/644-230-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4476-229-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4692-228-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/436-227-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4084-226-0x0000000000400000-0x000000000041C000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File opened (read-only) \??\O: 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File opened (read-only) \??\S: 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File opened (read-only) \??\U: 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File opened (read-only) \??\A: 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File opened (read-only) \??\B: 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File opened (read-only) \??\J: 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File opened (read-only) \??\K: 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File opened (read-only) \??\M: 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File opened (read-only) \??\R: 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File opened (read-only) \??\X: 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File opened (read-only) \??\H: 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File opened (read-only) \??\I: 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File opened (read-only) \??\V: 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File opened (read-only) \??\W: 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File opened (read-only) \??\Z: 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File opened (read-only) \??\G: 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File opened (read-only) \??\L: 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File opened (read-only) \??\Q: 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File opened (read-only) \??\T: 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File opened (read-only) \??\Y: 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File opened (read-only) \??\N: 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File opened (read-only) \??\P: 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\swedish cumshot bukkake uncut granny .mpeg.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\System32\DriverStore\Temp\italian cumshot blowjob hidden .mpg.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\SysWOW64\IME\SHARED\american fetish horse several models cock ejaculation .mpg.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\hardcore public titts bedroom (Jade).mpeg.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\SysWOW64\config\systemprofile\black handjob beast [bangbus] (Melissa).rar.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\SysWOW64\IME\SHARED\american nude bukkake voyeur hole .mpeg.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\american fetish bukkake masturbation hotel .mpeg.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\beast licking feet bondage .zip.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\SysWOW64\FxsTmp\spanish gay [bangbus] shower .rar.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\xxx [milf] castration .mpg.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\brasilian nude lesbian [milf] leather .avi.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\SysWOW64\FxsTmp\lingerie lesbian ash .mpg.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe -
Drops file in Program Files directory 18 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\italian nude trambling hot (!) .mpg.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\black nude gay licking titts YEâPSè& (Sarah).mpeg.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\japanese nude bukkake hot (!) bondage .rar.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\japanese cumshot blowjob uncut .rar.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Program Files (x86)\Google\Temp\japanese cum gay sleeping hotel .rar.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\asian bukkake full movie feet black hairunshaved .rar.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\Updates\Download\gay several models feet leather (Janette).rar.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\lingerie [bangbus] feet latex (Curtney).mpeg.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Templates\hardcore hot (!) feet blondie (Curtney).mpg.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\xxx big (Jade).avi.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\horse fucking sleeping hole latex (Janette).mpeg.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\fucking uncut (Janette).zip.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\bukkake [bangbus] feet .zip.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\brasilian animal trambling several models glans latex .avi.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\indian handjob hardcore catfight granny .zip.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Program Files (x86)\Google\Update\Download\danish action horse [free] YEâPSè& .zip.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\italian cum gay hot (!) feet swallow .avi.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Program Files (x86)\Microsoft\Temp\sperm girls hole YEâPSè& (Curtney).rar.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-jkshared-roaming_31bf3856ad364e35_10.0.19041.1_none_fa09f84703cb02c5\xxx hot (!) .mpg.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1202_none_d8a1416ab7cccdcf\sperm sleeping cock .rar.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\indian porn fucking voyeur gorgeoushorny .zip.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.1_none_5d54c0aac5c3c12c\japanese animal sperm [milf] glans gorgeoushorny .zip.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1_none_3cfd44d351b1a8ab\beast lesbian traffic .rar.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_adfc5e0bfca53431\swedish nude lesbian voyeur boots .zip.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.928_none_33e0d5558cdd7c61\italian handjob lesbian [free] lady .zip.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_855aff45853749ef\african sperm catfight 50+ (Sonja,Sarah).mpg.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_89c0bf1761110f07\hardcore uncut granny .mpeg.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\templates\black kicking beast licking mature .mpg.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.1_none_a80cea873b2a6772\xxx uncut shoes .zip.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\swedish cumshot sperm voyeur ejaculation .zip.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_4c786ae2f508e6d5\american horse horse uncut swallow .zip.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.19041.1_en-us_99ddc8ce8d3d6dac\malaysia bukkake public latex .rar.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_887b2378b7b5651d\porn beast girls feet high heels (Sarah).rar.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\security\templates\swedish porn lingerie several models femdom .avi.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_d38ece58f77171b4\xxx licking feet .mpg.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.1_none_9aa486d790131d4e\malaysia horse lesbian Ôï (Jenna,Jade).mpg.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_10.0.19041.1_none_bd731e5b85dd203e\lesbian hot (!) titts (Anniston,Karin).mpg.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.844_none_67b5915b5651dd8a\japanese kicking fucking big ash .mpeg.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_es-es_e5c3ad79c4e34ebb\malaysia sperm public titts high heels .rar.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\black nude blowjob [milf] penetration .mpg.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_es-es_211cf1c632a13851\xxx [bangbus] beautyfull .avi.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-composable-sharepicker_31bf3856ad364e35_10.0.19041.1_none_c87e96327faffd0e\swedish cumshot blowjob [free] .mpg.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5fdc43acc1be690d\lingerie hidden (Janette).avi.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\templates\italian action lingerie lesbian wifey .avi.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_de-de_881b257d159a5de8\asian fucking big .rar.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.1202_none_621728fcd3c9d5f6\sperm [bangbus] cock .mpeg.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.964_none_1c1a193f5bfcf136\kicking trambling [free] bondage (Britney,Tatjana).zip.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_en-us_5af076e0a3cb0fa7\hardcore hot (!) hole .avi.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_e79b400a6df5fd2c\british fucking uncut lady .avi.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\blowjob [milf] .avi.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_3d0229d17c310f10\chinese sperm uncut glans .mpg.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.746_none_d01527cffa9c25bc\hardcore [bangbus] shower .rar.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_es-es_bf79b5fcc06b3128\xxx masturbation redhair (Christine,Samantha).mpeg.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_10.0.19041.1_none_a3d9a07cf2290837\chinese xxx lesbian glans stockings (Sarah).mpeg.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\InputMethod\SHARED\black porn bukkake sleeping young .mpeg.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.789_en-us_58ebf9ecc407e3c0\tyrkish nude hardcore full movie young .rar.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_it-it_4c5922428a6f2d08\chinese blowjob sleeping granny .avi.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_19d22204a1f3fcaf\american horse fucking big glans redhair .mpeg.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_c6da8048542fddc7\british beast voyeur (Samantha).mpg.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5021dd18efc0460c\indian animal blowjob lesbian hole stockings (Sylvia).zip.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_10.0.19041.1_none_de1581e9a275faf8\action beast lesbian feet .zip.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..se-shared-datafiles_31bf3856ad364e35_10.0.19041.1_none_2f5f00d280dce9f6\spanish beast [free] cock granny (Tatjana).rar.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\russian horse blowjob masturbation titts (Sandy,Liz).zip.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.1266_none_7916f7558927ae23\chinese blowjob [milf] cock ejaculation (Janette).avi.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.746_none_d404daff82e97769\danish porn trambling sleeping cock lady .mpeg.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\Downloaded Program Files\sperm [milf] feet .mpeg.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c3d467c525734eb3\japanese cum fucking several models cock .avi.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_cb389cf57d74d691\brasilian beastiality trambling licking cock stockings (Karin).zip.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.1_none_f42978969c79336a\african sperm voyeur .mpg.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\japanese nude lesbian hidden (Liz).avi.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\japanese beastiality sperm full movie cock castration .avi.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.867_en-us_49453482f1fb5356\nude horse big .avi.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_de-de_16bd831fd16633be\danish action horse several models circumcision .mpeg.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_ee7ea14f7d8a3ee3\japanese nude xxx hot (!) femdom .zip.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\cumshot beast voyeur .mpg.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_de-de_3d077a9cd5de5151\cum hardcore sleeping stockings .zip.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\SoftwareDistribution\Download\SharedFileCache\xxx big titts (Kathrin,Samantha).rar.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_f3b35d713ce0fc7f\sperm public YEâPSè& .rar.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-jkshared-roaming_31bf3856ad364e35_10.0.19041.746_none_2212358fc33cc10f\british hardcore uncut .mpeg.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.1_none_a7ad1894592cfa12\black fetish fucking masturbation .rar.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_ab42fb092bda9182\horse trambling hidden beautyfull .zip.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.572_none_cf90e12518baac85\spanish trambling big feet .mpeg.exe 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4968 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 4968 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 4016 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 4016 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 4968 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 4968 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 380 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 380 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 3472 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 3472 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 4016 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 4016 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 4968 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 4968 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 1048 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 1048 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 2480 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 2480 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 4016 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 4016 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 380 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 380 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 1644 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 1644 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 3132 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 3132 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 4968 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 4968 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 3472 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 3472 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 1828 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 1828 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 3520 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 3520 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 932 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 932 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 1048 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 1048 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 380 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 380 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 4016 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 4016 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 3788 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 3788 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 3928 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 3928 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 4968 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 4968 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 3472 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 3472 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 4440 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 4440 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 4128 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 4128 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 3132 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 3132 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 1644 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 1644 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 2480 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 2480 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 4452 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 4452 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 3944 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 3944 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4968 wrote to memory of 4016 4968 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 87 PID 4968 wrote to memory of 4016 4968 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 87 PID 4968 wrote to memory of 4016 4968 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 87 PID 4016 wrote to memory of 380 4016 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 88 PID 4016 wrote to memory of 380 4016 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 88 PID 4016 wrote to memory of 380 4016 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 88 PID 4968 wrote to memory of 3472 4968 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 89 PID 4968 wrote to memory of 3472 4968 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 89 PID 4968 wrote to memory of 3472 4968 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 89 PID 4016 wrote to memory of 1048 4016 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 90 PID 4016 wrote to memory of 1048 4016 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 90 PID 4016 wrote to memory of 1048 4016 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 90 PID 380 wrote to memory of 2480 380 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 91 PID 380 wrote to memory of 2480 380 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 91 PID 380 wrote to memory of 2480 380 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 91 PID 4968 wrote to memory of 1644 4968 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 92 PID 4968 wrote to memory of 1644 4968 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 92 PID 4968 wrote to memory of 1644 4968 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 92 PID 3472 wrote to memory of 3132 3472 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 93 PID 3472 wrote to memory of 3132 3472 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 93 PID 3472 wrote to memory of 3132 3472 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 93 PID 1048 wrote to memory of 1828 1048 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 94 PID 1048 wrote to memory of 1828 1048 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 94 PID 1048 wrote to memory of 1828 1048 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 94 PID 4016 wrote to memory of 3520 4016 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 95 PID 4016 wrote to memory of 3520 4016 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 95 PID 4016 wrote to memory of 3520 4016 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 95 PID 380 wrote to memory of 932 380 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 96 PID 380 wrote to memory of 932 380 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 96 PID 380 wrote to memory of 932 380 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 96 PID 4968 wrote to memory of 3928 4968 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 97 PID 4968 wrote to memory of 3928 4968 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 97 PID 4968 wrote to memory of 3928 4968 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 97 PID 3472 wrote to memory of 3788 3472 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 98 PID 3472 wrote to memory of 3788 3472 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 98 PID 3472 wrote to memory of 3788 3472 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 98 PID 2480 wrote to memory of 4128 2480 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 99 PID 2480 wrote to memory of 4128 2480 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 99 PID 2480 wrote to memory of 4128 2480 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 99 PID 3132 wrote to memory of 4452 3132 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 100 PID 3132 wrote to memory of 4452 3132 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 100 PID 3132 wrote to memory of 4452 3132 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 100 PID 1644 wrote to memory of 4440 1644 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 101 PID 1644 wrote to memory of 4440 1644 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 101 PID 1644 wrote to memory of 4440 1644 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 101 PID 3520 wrote to memory of 3944 3520 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 102 PID 3520 wrote to memory of 3944 3520 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 102 PID 3520 wrote to memory of 3944 3520 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 102 PID 1048 wrote to memory of 388 1048 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 103 PID 1048 wrote to memory of 388 1048 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 103 PID 1048 wrote to memory of 388 1048 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 103 PID 1828 wrote to memory of 4084 1828 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 104 PID 1828 wrote to memory of 4084 1828 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 104 PID 1828 wrote to memory of 4084 1828 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 104 PID 380 wrote to memory of 436 380 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 105 PID 380 wrote to memory of 436 380 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 105 PID 380 wrote to memory of 436 380 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 105 PID 4016 wrote to memory of 4692 4016 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 106 PID 4016 wrote to memory of 4692 4016 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 106 PID 4016 wrote to memory of 4692 4016 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 106 PID 4968 wrote to memory of 3048 4968 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 107 PID 4968 wrote to memory of 3048 4968 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 107 PID 4968 wrote to memory of 3048 4968 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 107 PID 3472 wrote to memory of 2052 3472 5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"3⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:5724
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"8⤵PID:9340
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"9⤵PID:17560
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"8⤵PID:12468
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"8⤵PID:17512
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:164
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"8⤵PID:18960
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:9908
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"8⤵PID:16724
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:12772
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:16404
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:6136
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"8⤵PID:11400
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"8⤵PID:12508
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"8⤵PID:17536
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:7868
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"8⤵PID:17296
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:10788
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"8⤵PID:7572
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:12612
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:16120
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:13948
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:18904
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:7240
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:18112
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:10912
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:7368
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:12536
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:16056
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:5732
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:9388
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"8⤵PID:17184
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:12900
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:16240
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:5628
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:18856
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:9704
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:16548
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:12812
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:15720
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:13336
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:3004
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:7816
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:19228
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:10740
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:19000
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:12640
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:16356
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:11328
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:7576
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:12516
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:16112
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:7228
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:18096
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:11096
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:12564
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:16104
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:932 -
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:5748
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:9380
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"8⤵PID:17544
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:12884
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:16420
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:7320
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:18880
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:10308
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:14396
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:18444
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:12692
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:16260
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:8268
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:18864
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:13364
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:18064
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:6200
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:12928
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:16388
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:8408
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:18088
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:13088
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:18136
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:5716
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:9672
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:16564
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:12788
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:16376
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:7160
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:17248
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:10272
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:16272
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:12732
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:2012
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:7828
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:19412
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:10780
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:14404
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:18992
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:12604
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:17496
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:5812
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:13096
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:18436
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:7292
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:19236
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:13152
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:18040
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"3⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:5764
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:9580
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"8⤵PID:17552
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:12828
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:17416
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:7132
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:17288
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:9972
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:18024
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:12740
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:17104
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:6308
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:18888
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:13432
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:18048
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:6284
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:13040
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:17216
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:8824
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:16556
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:13000
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:16700
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:5708
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:9572
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:16892
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:12844
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:16436
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:6432
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:17176
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:9688
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:16588
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:12836
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:17528
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:8244
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:18936
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:13956
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:19216
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:6232
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:12960
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:16732
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:8672
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:16900
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:13008
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:17480
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"3⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:5692
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:9664
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:16796
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:12852
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:16428
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:7116
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:17312
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:10292
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:16332
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:12724
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:16364
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:9220
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:17264
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:12944
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:1500
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:6256
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:13128
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:17256
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:8428
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:16780
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:13344
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:17332
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"3⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:5680
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:10592
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:15028
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:19248
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:12684
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:16152
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:7100
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:18848
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:9980
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:17192
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:12804
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:3580
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"3⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:8392
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:17448
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:13032
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:16708
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"3⤵PID:6240
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:13484
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:18120
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"3⤵PID:8436
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:18944
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"3⤵PID:13064
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"3⤵PID:17432
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"3⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:5576
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:9988
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"8⤵PID:16348
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:12756
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:14700
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:7108
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:13072
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:17660
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:9880
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:16516
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:12764
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:2852
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:8112
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:18912
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:10772
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:19008
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:12576
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:16296
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:6248
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:12968
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:17472
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:8416
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:16884
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:13056
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:16740
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:5740
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:11188
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:12548
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:16128
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:6452
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:17208
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:9996
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:16664
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:12748
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:16252
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:8400
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:16540
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:13048
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:17240
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:6008
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:13136
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:17504
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:8212
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:18928
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:13104
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:18056
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"3⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:5756
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:9348
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:16604
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:12476
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:16048
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:5592
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:17232
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:9648
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:16524
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:12868
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:16216
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:6424
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:18952
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:9680
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:16788
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:12796
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:860
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:11456
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:23480
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:12496
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:16032
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:8104
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:18104
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:10896
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:19256
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:12592
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:17488
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"3⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:5780
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:10192
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:16572
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:12484
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:16040
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:5676
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:18872
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:10264
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:16580
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:12708
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:16136
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"3⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:7300
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:16772
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:10300
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:16340
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:12700
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:16144
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"3⤵PID:6276
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:13112
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:17272
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"3⤵PID:8492
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:17280
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"3⤵PID:13024
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"3⤵PID:16208
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"3⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:5648
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:9332
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"7⤵PID:16612
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:12908
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:16396
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:6896
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:13348
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:17064
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:8288
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:16620
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:12920
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:17456
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:5616
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:13776
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:17056
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:9656
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:16908
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:12860
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:14732
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:6208
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:13472
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:17424
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:8484
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:16764
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:13016
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:17324
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"3⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:5568
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:9588
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:16532
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:12876
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:14720
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:6860
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:12936
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:17464
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:9112
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:17224
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:12976
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:16692
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"3⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:7608
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:18080
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:10576
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:13792
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:2128
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:12676
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:18032
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"3⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:13144
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:16168
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"3⤵PID:7296
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:18896
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"3⤵PID:10840
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:13784
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:4324
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"3⤵PID:13512
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"3⤵PID:18128
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"3⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:5700
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:9356
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"6⤵PID:17400
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:12892
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:16228
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:5600
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:18920
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:9696
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:16596
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:12820
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:2432
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"3⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:8892
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:18828
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:12952
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:16236
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"3⤵PID:6224
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:13120
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:17304
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"3⤵PID:8476
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:16756
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"3⤵PID:12984
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"3⤵PID:17440
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"2⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"3⤵PID:5772
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:10280
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"5⤵PID:18072
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:12716
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:16320
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"3⤵PID:7152
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:18972
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"3⤵PID:9900
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:16380
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"3⤵PID:12780
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"3⤵PID:16412
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"2⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"3⤵PID:8124
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:17200
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"3⤵PID:10828
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:13328
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"4⤵PID:17520
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"3⤵PID:12624
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"3⤵PID:16064
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"2⤵PID:6216
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"3⤵PID:13080
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"3⤵PID:16716
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"2⤵PID:8764
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"3⤵PID:16748
-
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"2⤵PID:12992
-
-
C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5aa7aca0d734b0e9278ca98d8548b950_NeikiAnalytics.exe"2⤵PID:16684
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\xxx big (Jade).avi.exe
Filesize938KB
MD5b32c108d94ba181c41b96455232326fd
SHA19f2b0688bf006233c17edd130d97a37c120c7068
SHA256e3e5903818502d71cac3a1d1bef3bede5662275b75ecbfa0e0e7a674118e020b
SHA512f859e624c336d0c044311d40260e010f75cd0ae57ed5f40ca11fc4b761ccfb0f642cf7bb258df725fd1a247d039e92aaaf6b7f75d00f8eca3c7f97f54840b30c