Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30/05/2024, 23:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe
Resource
win7-20240221-en
7 signatures
150 seconds
General
-
Target
6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe
-
Size
52KB
-
MD5
6c979816b9628eb74681d0943134cd90
-
SHA1
3debb15c8f8a40e2cb69ab1bc66ead97620f2335
-
SHA256
9e88058e17d79220b1b56ff51c7579247eac719d9c6592ae8ee7a8a143aca8eb
-
SHA512
fbf85d79a4cf09fd9d6e61c5cf11d7b6448caa507da44b593e6d839e1c34158f6812c884aaf4807e19069d1379cdd9aadaa1f09842dffa0bf9d625c12ef12c73
-
SSDEEP
768:FlQ4hrvaEGU4aikqykezg2XpfYpbjYioRo62Bl5:fLhE1Dezg2ZfYpyoBf5
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened (read-only) \??\Z: 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened (read-only) \??\O: 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened (read-only) \??\R: 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened (read-only) \??\M: 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened (read-only) \??\T: 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened (read-only) \??\V: 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened (read-only) \??\Y: 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened (read-only) \??\H: 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened (read-only) \??\K: 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened (read-only) \??\I: 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened (read-only) \??\J: 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened (read-only) \??\Q: 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened (read-only) \??\S: 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened (read-only) \??\W: 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened (read-only) \??\E: 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened (read-only) \??\G: 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened (read-only) \??\P: 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened (read-only) \??\U: 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened (read-only) \??\L: 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened (read-only) \??\N: 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\SETTINGSYNCHOST.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\SFC.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\INSTALLSHIELD\_ISDEL.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\WOWREG32.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\MOBSYNC.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\WLANEXT.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\RUNONCE.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\CERTENROLLCTRL.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMETC\IMTCLNWZ.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\ISCSICLI.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\WBEM\WMIPRVSE.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\AUTOFMT.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\COMPACT.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\FC.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\FONTDRVHOST.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\SHRPUBW.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\TPMINIT.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\CHARMAP.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\DXDIAG.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\AGENTACTIVATIONRUNTIMESTARTER.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\DCCW.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\OPENWITH.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\OPOSHOST.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\PASSWORDONWAKESETTINGFLYOUT.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\SEARCHFILTERHOST.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\WINRTNETMUAHOSTSERVER.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\AUDITPOL.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\HOSTNAME.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\NET.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\SORT.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\WPDSHEXTAUTOPLAY.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\DLLHOST.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\DPISCALING.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\ISCSICPL.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\NETCFGNOTIFYOBJECTHOST.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\TYPEPERF.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\WINDOWS.WARP.JITSERVICE.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\CALC.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\EVENTVWR.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\MMGASERVER.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\SXSTRACE.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMINFO.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\CMDL32.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\CTTUNE.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\RESMON.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\USERACCOUNTBROKER.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\COLORCPL.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\NET1.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\RELOG.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\SDIAGNHOST.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\STORDIAG.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\WSMANHTTPCONFIG.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\EXPAND.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\RRINSTALLER.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\SPATIALAUDIOLICENSESRV.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\RMACTIVATE_SSP.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\FIXMAPI.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\FSUTIL.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\HDWWIZ.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\REGSVR32.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\WSCRIPT.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\ESENTUTL.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\COM\COMREPL.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\CTTUNESVR.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\INTERNET EXPLORER\IELOWUTIL.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESX86\MICROSOFT OFFICE\OFFICE16\DCF\COMMON.DBCONNECTION64.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\PINGSENDER.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMPSHARE.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\PACK200.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\WORDICON.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX64\MICROSOFT SHARED\SOURCE ENGINE\OSE.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.XBOX.TCUI_1.23.28002.0_X64__8WEKYB3D8BBWE\TCUI-APP.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.XBOXIDENTITYPROVIDER_12.50.6001.0_X64__8WEKYB3D8BBWE\XBOXIDP.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\DOTNET\SHARED\MICROSOFT.NETCORE.APP\7.0.16\CREATEDUMP.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\KEYTOOL.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\ADDINS\MICROSOFT POWER QUERY FOR EXCEL INTEGRATED\BIN\MICROSOFT.MASHUP.CONTAINER.NETFX40.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMLAUNCH.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\KLIST.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JAVA-RMI.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.YOURPHONE_0.19051.7.0_X64__8WEKYB3D8BBWE\YOURPHONE.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES (X86)\INTERNET EXPLORER\EXTEXPORT.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\INK\SHAPECOLLECTOR.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\CLIENT\APPVDLLSURROGATE32.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\ADDINS\MICROSOFT POWER QUERY FOR EXCEL INTEGRATED\BIN\MICROSOFT.MASHUP.CONTAINER.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\XLICONS.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\VIDEOLAN\VLC\UNINSTALL.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.ZUNEMUSIC_10.19071.19011.0_X64__8WEKYB3D8BBWE\MUSIC.UI.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ARH.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\RMIREGISTRY.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSOEV.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.MIXEDREALITY.PORTAL_2000.19081.1301.0_X64__8WEKYB3D8BBWE\MIXEDREALITYPORTAL.BROKERED.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\JAVA-RMI.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSOSREC.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\LYNCICON.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\WOW_HELPER.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\DOTNET\DOTNET.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JDB.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE 15\CLIENTX64\OFFICECLICKTORUN.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.MIXEDREALITY.PORTAL_2000.19081.1301.0_X64__8WEKYB3D8BBWE\MIXEDREALITYPORTAL.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\JAVA\JAVA UPDATE\JUCHECK.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JAVAW.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\JP2LAUNCHER.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.GETHELP_10.1706.13331.0_X64__8WEKYB3D8BBWE\GETHELP.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.PEOPLE_10.1902.633.0_X64__8WEKYB3D8BBWE\PEOPLEAPP.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\92.0.902.67\ELEVATION_SERVICE.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\RMID.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.XBOXGAMEOVERLAY_1.46.11001.0_X64__8WEKYB3D8BBWE\GAMEBAR.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MAIL\WABMIG.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\JABSWITCH.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESX64\MICROSOFT ANALYSIS SERVICES\AS OLEDB\140\SQLDUMPER.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\ACCICONS.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ACROCEF\RDRSERVICESUPDATER.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\JAVA\JAVA UPDATE\JAUREG.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.151\GOOGLECRASHHANDLER.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\MISC.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\VISICON.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPNETWK.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\RMID.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.HEIFIMAGEEXTENSION_1.0.22742.0_X64__8WEKYB3D8BBWE\CODECPACKS.HEIF.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.STOREPURCHASEAPP_11811.1001.18.0_X64__8WEKYB3D8BBWE\STOREEXPERIENCEHOST.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.XBOXSPEECHTOTEXTOVERLAY_1.17.29001.0_X64__8WEKYB3D8BBWE\SPEECHTOTEXTOVERLAY64-RETAIL.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ORACLE\JAVA\JAVAPATH\JAVA.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_BK\MICROSOFTEDGEUPDATE.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\KTAB.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\CLIENT\APPVDLLSURROGATE64.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\INTEGRATION\ADDONS\ONEDRIVESETUP.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\GRAPH.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\MINIDUMP-ANALYZER.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-P..NCETOOLSCOMMANDLINE_31BF3856AD364E35_10.0.19041.546_NONE_49716C2392052ACA\TYPEPERF.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-P..RIENCEHOST.APPXMAIN_31BF3856AD364E35_10.0.19041.423_NONE_BFCB7B02F95B1E52\F\PEOPLEEXPERIENCEHOST.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-M..PLAYER-SHELLPREVIEW_31BF3856AD364E35_10.0.19041.1266_NONE_3563A6B72868B6D9\F\WMPRPH.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SHELL-PREVIEWHOST_31BF3856AD364E35_10.0.19041.746_NONE_2136AFEF5FADEAA4\R\PREVHOST.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WMI-CONSUMERS_31BF3856AD364E35_10.0.19041.1_NONE_00C334EBF83EE740\SCRCONS.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-SCTASKS_31BF3856AD364E35_10.0.19041.906_NONE_72B8B02E4865EBCA\SCHTASKS.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-A..ROBLEMSTEPSRECORDER_31BF3856AD364E35_10.0.19041.746_NONE_B8EADBF8A9C907B3\F\PSR.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_HYPERV-COMPUTE-CONT..UTIONSERVICE-SHARED_31BF3856AD364E35_10.0.19041.928_NONE_33E0D5558CDD7C61\CEXECSVC.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-P..NCETOOLSCOMMANDLINE_31BF3856AD364E35_10.0.19041.546_NONE_3F1CC1D15DA468CF\R\DISKPERF.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..MSETTINGS-DATAMODEL_31BF3856AD364E35_10.0.19041.746_NONE_C82B4B805B9AE361\R\SYSTEMSETTINGSBROKER.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-D..DIRECTPLAY4-PAYLOAD_31BF3856AD364E35_1.0.19041.1_NONE_598949F46770A8B9\DPLAYSVR.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-IE-IEXPRESS_31BF3856AD364E35_11.0.19041.1_NONE_F23FC9B9908BE4FC\IEXPRESS.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\SMSVCHOST.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-P..NCETOOLSCOMMANDLINE_31BF3856AD364E35_10.0.19041.1_NONE_171488549E32A4D3\TRACERPT.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_SMSVCHOST_B03F5F7F11D50A3A_4.0.15805.0_NONE_6D5F51303F9ACA21\SMSVCHOST.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_WINDOWS-APPLICATION..HARINGSVC-NTSERVICE_31BF3856AD364E35_10.0.19041.84_NONE_C43E71AF69351575\DSTOKENCLEAN.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.ACCOUNTSCONTROL_CW5N1H2TXYEWY\ACCOUNTSCONTROLHOST.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MSAUDITTOOLS_31BF3856AD364E35_10.0.19041.546_NONE_F57E58B71B913C6B\F\AUDITPOL.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..HRESHOLD-ADMINFLOWS_31BF3856AD364E35_10.0.19041.1023_NONE_9583D52FD3076014\F\SYSTEMSETTINGSADMINFLOWS.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\ASPNET_WP.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-LPKSETUP_31BF3856AD364E35_10.0.19041.153_NONE_FF44CFA7CB529CE3\LPREMOVE.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\TEMP\PENDINGDELETES\A267614236E5D701639700001815341F.UWFSERVICINGSVC.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-RASCONNECTIONMANAGER_31BF3856AD364E35_10.0.19041.1_NONE_1F65F7473443D565\CMMON32.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-D..OMMANDLINE-DSDBUTIL_31BF3856AD364E35_10.0.19041.1_NONE_996BA223B673811B\DSDBUTIL.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_HYPERV-VMSP_31BF3856AD364E35_10.0.19041.1_NONE_39D506065BD87607\VMSP.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-CAPTUREPICKER.APPXMAIN_31BF3856AD364E35_10.0.19041.423_NONE_12CA604B48F8D3FB\R\CAPTUREPICKER.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-CLEANMGR_31BF3856AD364E35_10.0.19041.1266_NONE_E20A09E712BD275C\R\CLEANMGR.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SQM-CONSOLIDATOR-BASE_31BF3856AD364E35_10.0.19041.84_NONE_CBE289218FB48371\F\WSQMCONS.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..ES-WORKSPACERUNTIME_31BF3856AD364E35_10.0.19041.746_NONE_045E85893C117E35\R\WKSPRT.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_WINDOWSSEARCHENGINE_31BF3856AD364E35_7.0.19041.1151_NONE_EC390BD802A1C630\R\SEARCHPROTOCOLHOST.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-AUTOFMT_31BF3856AD364E35_10.0.19041.1266_NONE_650EBAB5A8C02FFC\AUTOFMT.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-REGISTRY-EDITOR_31BF3856AD364E35_10.0.19041.746_NONE_DC7CAA836F08AD57\REGEDIT.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.0\WINDOWS COMMUNICATION FOUNDATION\SERVICEMODELREG.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MEDIAPLAYER-CORE_31BF3856AD364E35_10.0.19041.1266_NONE_802F96A5044B0FBE\WMPSHARE.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-NOTEPAD_31BF3856AD364E35_10.0.19041.117_NONE_4D353CF1CEB5D6D2\F\NOTEPAD.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_WINDOWS-SENSECLIENT-SERVICE_31BF3856AD364E35_10.0.19041.1288_NONE_1CEC63974464878F\R\SENSESAMPLEUPLOADER.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\MSIL_IEEXEC_B03F5F7F11D50A3A_10.0.19041.1_NONE_3FC8DDFD98AD3137\IEEXEC.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\TEMP\PENDINGDELETES\E374984536E5D701109B00001815341F.IISRSTAS.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-MAGNIFY_31BF3856AD364E35_10.0.19041.1266_NONE_ED4855448241F7E7\MAGNIFY.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-RUNONCE_31BF3856AD364E35_10.0.19041.1202_NONE_94CFABD8A89F0B96\RUNONCE.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-CORESYSTEM-WPR_31BF3856AD364E35_10.0.19041.746_NONE_4028B8F4F6C0B829\F\WPR.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-REGSVR32_31BF3856AD364E35_10.0.19041.1_NONE_2E482AD4CEE11EAD\REGSVR32.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-M..S-MDAC-ODBCCONF-EXE_31BF3856AD364E35_10.0.19041.1_NONE_C367E800917ABC7D\ODBCCONF.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-LXSS-BASH_31BF3856AD364E35_10.0.19041.1151_NONE_B46B739F71BBB8B7\F\BASH.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-G..ATION-WINCOMPONENTS_31BF3856AD364E35_10.0.19041.1_NONE_51B7888297A3C04E\LOCATIONNOTIFICATIONWINDOWS.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-P..NFIGURATION-CMDLINE_31BF3856AD364E35_10.0.19041.1_NONE_BF4CC5BB201CAAE3\POWERCFG.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-CAPTUREPICKER.APPXMAIN_31BF3856AD364E35_10.0.19041.423_NONE_12CA604B48F8D3FB\F\CAPTUREPICKER.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-U..TE-ORCHESTRATORCORE_31BF3856AD364E35_10.0.19041.1266_NONE_FB98272B39A47240\R\MOUSOCOREWORKER.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-U..SNOTIFICATIONBROKER_31BF3856AD364E35_10.0.19041.153_NONE_42505A6DE732F7CA\F\MUSNOTIFICATION.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-R..CKGROUNDMEDIAPLAYER_31BF3856AD364E35_10.0.19041.1266_NONE_3B00801193B15C0F\WINDOWS.MEDIA.BACKGROUNDPLAYBACK.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-APPX-DEPLOYMENT-SERVER_31BF3856AD364E35_10.0.19041.1288_NONE_D616F4B76BD7B8A2\APPLYTRUSTOFFLINE.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..ES-COMMANDLINETOOLS_31BF3856AD364E35_10.0.19041.1_NONE_9AA166E99861C2BC\CHGUSR.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-D..D-SEARCHINTEGRATION_31BF3856AD364E35_10.0.19041.746_NONE_6E05A6BB2291B4C6\IMESEARCH.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-WOW64-LEGACY_31BF3856AD364E35_10.0.19041.1023_NONE_6AEAB5D4BD0371A8\F\SETUP16.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\ASSEMBLY\GAC_MSIL\DFSVC\2.0.0.0__B03F5F7F11D50A3A\DFSVC.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..ES-COMMANDLINETOOLS_31BF3856AD364E35_10.0.19041.1_NONE_9AA166E99861C2BC\TSCON.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-MEDIAPLAYER-AUTOPLAY_31BF3856AD364E35_10.0.19041.1266_NONE_9A152E76298CD801\R\WMLAUNCH.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-RASCONNECTIONMANAGER_31BF3856AD364E35_10.0.19041.746_NONE_476E348FF3B593AF\CMDL32.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..DARYAUTHFACTOR-TASK_31BF3856AD364E35_10.0.19041.746_NONE_A9FF72B1A43FD663\R\DEVICECREDENTIALDEPLOYMENT.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-ONECORE-D..ECTXDATABASEUPDATER_31BF3856AD364E35_10.0.19041.84_NONE_2D21E26A18D595C7\R\DIRECTXDATABASEUPDATER.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-EMBEDDED-SHELLLAUNCHER_31BF3856AD364E35_10.0.19041.1202_NONE_B918E36FFC7A6FFE\R\ESHELL.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-UNP_31BF3856AD364E35_10.0.19041.264_NONE_8ADC8BD8B75D383F\UNPUXHOST.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_WINDOWSSEARCHENGINE_31BF3856AD364E35_7.0.19041.1151_NONE_F68DB62A3702882B\R\SEARCHPROTOCOLHOST.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..D-SEARCHINTEGRATION_31BF3856AD364E35_10.0.19041.1_NONE_3BA8BF202EBF3481\IMESEARCH.EXE 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4920 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe 4920 6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6c979816b9628eb74681d0943134cd90_NeikiAnalytics.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:4920