Analysis
-
max time kernel
15s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 01:05
Behavioral task
behavioral1
Sample
18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe
-
Size
2.0MB
-
MD5
18f54bb16e8c891225a48f5db6342790
-
SHA1
00f30f82e00f38ca832d560e9322449cefc462af
-
SHA256
af7e34eff1fe060c689efadf7bbf65241e5031ba565d902e350a5a17305b27bf
-
SHA512
3412175bec496bf9c910617e4216c7ef087dc0cff8bb90a11d2bcebb9fe68b5cd28005d984aae723ac6462ee93fe1d2536a97d4da89c1d68ae3daf02f0794904
-
SSDEEP
49152:NaF5FkZZfBeEBGKO7nsOiGYxOhMkZ8A7IEP:NiFkZFBXBGWGYYhR8Bi
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 29 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/1464-0-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/files/0x0007000000023436-5.dat upx behavioral2/memory/760-112-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4364-162-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4076-161-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2784-181-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4676-182-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4516-183-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1752-184-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2296-185-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3532-186-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4392-187-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2204-188-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1464-189-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/760-190-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4076-191-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4364-192-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3672-195-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4676-194-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2784-193-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4516-197-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1348-198-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1752-199-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3804-200-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2296-201-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3532-202-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4392-203-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1940-204-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2204-205-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1440-207-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3676-206-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2392-208-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4804-209-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3804-210-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/372-214-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4524-216-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2652-215-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4912-218-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2392-219-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1440-217-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1560-220-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3584-221-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4708-222-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2740-223-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/5772-224-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/5132-227-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/5124-225-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/5940-234-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4532-235-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4912-236-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/6120-237-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/6160-246-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/5804-245-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/6152-244-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/5688-243-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/5180-242-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/6072-241-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/6064-240-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/6056-239-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/6080-238-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4524-233-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2652-232-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3556-231-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/5164-230-0x0000000000400000-0x000000000041E000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File opened (read-only) \??\L: 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File opened (read-only) \??\V: 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File opened (read-only) \??\T: 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File opened (read-only) \??\W: 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File opened (read-only) \??\Z: 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File opened (read-only) \??\A: 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File opened (read-only) \??\B: 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File opened (read-only) \??\E: 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File opened (read-only) \??\N: 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File opened (read-only) \??\S: 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File opened (read-only) \??\Y: 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File opened (read-only) \??\H: 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File opened (read-only) \??\J: 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File opened (read-only) \??\O: 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File opened (read-only) \??\P: 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File opened (read-only) \??\X: 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File opened (read-only) \??\U: 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File opened (read-only) \??\I: 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File opened (read-only) \??\K: 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File opened (read-only) \??\M: 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File opened (read-only) \??\Q: 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File opened (read-only) \??\R: 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\tyrkish beast hardcore several models blondie .mpeg.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\SysWOW64\config\systemprofile\german gang bang hot (!) .mpeg.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\System32\DriverStore\Temp\spanish gay bukkake big (Gina).zip.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\SysWOW64\FxsTmp\spanish action gang bang hidden hole granny (Sarah,Sonja).zip.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\SysWOW64\IME\SHARED\italian gay masturbation nipples .zip.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\hardcore beastiality public sm .mpg.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\norwegian beastiality sleeping ash (Kathrin,Liz).avi.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\cum public titts mature .avi.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\SysWOW64\IME\SHARED\indian blowjob fetish [milf] (Tatjana,Ashley).avi.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\swedish blowjob lingerie [free] balls .rar.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\malaysia sperm hardcore hot (!) feet stockings .mpg.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\SysWOW64\FxsTmp\cumshot xxx [bangbus] (Jenna,Britney).avi.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe -
Drops file in Program Files directory 18 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\nude girls stockings .mpg.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\chinese cumshot big feet ash .rar.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Program Files (x86)\Google\Update\Download\beast voyeur beautyfull .mpeg.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\spanish horse lesbian cock ejaculation .mpg.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\canadian kicking licking bondage (Christine).zip.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\asian beast fucking full movie ash .avi.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Program Files (x86)\Microsoft\Temp\fetish several models castration .rar.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\gang bang [milf] hole boots .mpg.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\Updates\Download\malaysia animal public .mpeg.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\horse full movie ,Ó .mpeg.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\action gang bang several models cock blondie .rar.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\danish action fucking [bangbus] .mpg.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Templates\swedish nude voyeur black hairunshaved .mpg.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\nude full movie (Karin,Tatjana).zip.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\spanish cumshot big .avi.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\tyrkish xxx porn hot (!) boobs circumcision .zip.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Program Files (x86)\Google\Temp\french beastiality fetish girls titts (Tatjana).zip.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\action xxx public .mpeg.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\ServiceProfiles\NetworkService\Downloads\danish trambling xxx uncut titts (Ashley).rar.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.867_en-us_49453482f1fb5356\brasilian nude fucking licking (Janette).avi.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1288_none_ca3007304990b2ea\asian horse cumshot masturbation young (Kathrin).avi.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1_none_0b596e2a33be7d4c\norwegian sperm hidden ash .zip.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_10.0.19041.1_none_bd731e5b85dd203e\african lingerie voyeur wifey .rar.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.153_none_e23c926e32d07dc1\animal kicking masturbation nipples (Anniston,Liz).mpeg.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\fucking blowjob catfight penetration .rar.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_855aff45853749ef\bukkake nude lesbian mature .zip.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\assembly\temp\tyrkish porn fucking [bangbus] high heels .mpeg.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_es-es_211cf1c632a13851\french fucking [free] blondie .mpg.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_1bbb9ab9fc52bac9\chinese handjob action sleeping (Anniston,Britney).rar.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.1_none_abfc9db6c377b91f\spanish cum beastiality big Ôï .mpg.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_it-it_72a319bf8ee74a9b\british fetish gay [free] glans .mpeg.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5021dd18efc0460c\tyrkish sperm [milf] Ôï .zip.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_de-de_881b257d159a5de8\beastiality girls .avi.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_f07d4fae3e8e883f\cum blowjob sleeping cock (Britney).mpeg.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\InputMethod\SHARED\brasilian animal cumshot full movie balls .mpg.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.1266_none_7916f7558927ae23\asian fetish horse [free] bedroom (Jenna).avi.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\templates\malaysia hardcore horse full movie leather (Gina,Jade).zip.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c3d467c525734eb3\chinese fucking action [bangbus] hotel (Britney).rar.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5fdc43acc1be690d\beast action voyeur ash .avi.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.746_none_d01527cffa9c25bc\horse trambling hot (!) nipples YEâPSè& .avi.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\kicking full movie stockings .mpeg.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.1_none_833abdc06c68d338\british action handjob masturbation .mpeg.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.867_none_c29826784f9429f8\lesbian beastiality [free] traffic .rar.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_c6da8048542fddc7\handjob beast voyeur ash .rar.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\PLA\Templates\trambling fucking voyeur ash upskirt .mpg.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_10.0.19041.1_none_ae957c4c35a7bf73\american sperm lingerie big girly .mpg.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_en-us_bfae5918c0443f83\danish bukkake gay licking mistress .zip.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1202_none_d8a1416ab7cccdcf\horse cumshot hot (!) .mpeg.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\american gang bang full movie .mpg.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_en-us_215194e2327a46ac\chinese hardcore hardcore catfight high heels .mpg.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..se-shared-datafiles_31bf3856ad364e35_10.0.19041.1_none_2f5f00d280dce9f6\canadian trambling voyeur vagina (Jenna,Britney).zip.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_de-de_3d077a9cd5de5151\fucking fucking hot (!) .rar.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.844_none_57eddd48e7a74274\tyrkish porn horse lesbian (Britney).avi.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_es-es_bf79b5fcc06b3128\russian fetish kicking masturbation cock .rar.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\Downloaded Program Files\italian horse catfight .rar.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.1_none_0bc0f3d4cd7dc8fd\african kicking porn public .zip.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_3d0229d17c310f10\danish handjob cumshot licking .mpeg.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.1_none_9aa486d790131d4e\handjob lingerie girls traffic (Ashley).mpeg.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1_none_3cfd44d351b1a8ab\handjob beastiality several models .avi.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_b1ffa0e7b4ed03e2\norwegian action action licking (Sarah).avi.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\chinese handjob [milf] 50+ .mpeg.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_7860bee9439c3ae7\malaysia lingerie kicking [bangbus] hole Ôï .avi.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..gement-uevtemplates_31bf3856ad364e35_10.0.19041.1_none_0d66b54875835a49\russian action voyeur 40+ .rar.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_4c786ae2f508e6d5\italian kicking porn lesbian legs leather .avi.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_62312bfbb33d478a\lingerie lesbian full movie .mpeg.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.1_none_f42978969c79336a\russian trambling lesbian [free] legs hotel (Sarah).mpeg.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\canadian nude fetish public .mpeg.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\SoftwareDistribution\Download\SharedFileCache\british action porn masturbation .avi.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_14c898cc82025c76\kicking gang bang catfight .rar.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\malaysia horse hidden .mpeg.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_d38ece58f77171b4\asian cumshot hidden black hairunshaved (Gina).avi.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_ab42fb092bda9182\horse lingerie public upskirt .rar.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_2fe79eae2833b9b1\indian handjob masturbation vagina Ôï .mpeg.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_it-it_4c5922428a6f2d08\swedish fucking beast voyeur .rar.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_es-es_5abbd3c4a3f2014c\black animal hot (!) feet sm (Melissa,Liz).avi.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.928_none_33e0d5558cdd7c61\brasilian handjob gang bang masturbation nipples upskirt .avi.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_es-es_30d7585a049f5b52\lingerie fucking sleeping titts fishy .avi.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_10.0.19041.1_none_de1581e9a275faf8\black cum licking hotel .mpeg.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-jkshared-roaming_31bf3856ad364e35_10.0.19041.1_none_fa09f84703cb02c5\american bukkake nude [milf] YEâPSè& .avi.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\animal hot (!) .rar.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.1_none_a80cea873b2a6772\japanese fetish horse full movie traffic .mpg.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\asian blowjob sperm [milf] (Samantha).mpg.exe 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1464 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 1464 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 760 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 760 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 1464 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 1464 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 4076 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 4076 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 4364 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 4364 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 760 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 1464 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 760 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 1464 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 4676 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 4676 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 2784 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 2784 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 4516 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 4516 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 760 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 760 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 1464 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 1464 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 4076 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 4076 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 1752 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 1752 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 4364 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 4364 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 2296 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 2296 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 3532 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 3532 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 1464 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 1464 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 760 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 760 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 2784 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 4392 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 2784 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 4392 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 2204 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 2204 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 712 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 712 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 4076 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 4076 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 1576 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 1576 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 4364 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 4364 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 4228 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 4228 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 4676 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 4676 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 4516 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 4516 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 3672 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 3672 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 1752 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 1752 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 1348 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 1348 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1464 wrote to memory of 760 1464 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 85 PID 1464 wrote to memory of 760 1464 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 85 PID 1464 wrote to memory of 760 1464 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 85 PID 760 wrote to memory of 4076 760 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 86 PID 760 wrote to memory of 4076 760 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 86 PID 760 wrote to memory of 4076 760 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 86 PID 1464 wrote to memory of 4364 1464 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 87 PID 1464 wrote to memory of 4364 1464 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 87 PID 1464 wrote to memory of 4364 1464 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 87 PID 760 wrote to memory of 2784 760 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 90 PID 760 wrote to memory of 2784 760 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 90 PID 760 wrote to memory of 2784 760 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 90 PID 1464 wrote to memory of 4676 1464 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 91 PID 1464 wrote to memory of 4676 1464 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 91 PID 1464 wrote to memory of 4676 1464 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 91 PID 4076 wrote to memory of 4516 4076 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 92 PID 4076 wrote to memory of 4516 4076 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 92 PID 4076 wrote to memory of 4516 4076 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 92 PID 4364 wrote to memory of 1752 4364 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 93 PID 4364 wrote to memory of 1752 4364 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 93 PID 4364 wrote to memory of 1752 4364 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 93 PID 760 wrote to memory of 2296 760 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 96 PID 760 wrote to memory of 2296 760 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 96 PID 760 wrote to memory of 2296 760 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 96 PID 1464 wrote to memory of 3532 1464 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 97 PID 1464 wrote to memory of 3532 1464 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 97 PID 1464 wrote to memory of 3532 1464 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 97 PID 2784 wrote to memory of 4392 2784 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 98 PID 2784 wrote to memory of 4392 2784 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 98 PID 2784 wrote to memory of 4392 2784 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 98 PID 4076 wrote to memory of 2204 4076 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 99 PID 4076 wrote to memory of 2204 4076 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 99 PID 4076 wrote to memory of 2204 4076 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 99 PID 4364 wrote to memory of 712 4364 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 100 PID 4364 wrote to memory of 712 4364 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 100 PID 4364 wrote to memory of 712 4364 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 100 PID 4676 wrote to memory of 1576 4676 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 101 PID 4676 wrote to memory of 1576 4676 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 101 PID 4676 wrote to memory of 1576 4676 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 101 PID 4516 wrote to memory of 4228 4516 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 102 PID 4516 wrote to memory of 4228 4516 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 102 PID 4516 wrote to memory of 4228 4516 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 102 PID 1752 wrote to memory of 3672 1752 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 103 PID 1752 wrote to memory of 3672 1752 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 103 PID 1752 wrote to memory of 3672 1752 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 103 PID 1464 wrote to memory of 1348 1464 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 105 PID 1464 wrote to memory of 1348 1464 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 105 PID 1464 wrote to memory of 1348 1464 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 105 PID 3532 wrote to memory of 2712 3532 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 107 PID 3532 wrote to memory of 2712 3532 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 107 PID 3532 wrote to memory of 2712 3532 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 107 PID 760 wrote to memory of 3804 760 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 106 PID 760 wrote to memory of 3804 760 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 106 PID 760 wrote to memory of 3804 760 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 106 PID 2296 wrote to memory of 2788 2296 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 108 PID 2296 wrote to memory of 2788 2296 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 108 PID 2296 wrote to memory of 2788 2296 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 108 PID 2784 wrote to memory of 2016 2784 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 109 PID 2784 wrote to memory of 2016 2784 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 109 PID 2784 wrote to memory of 2016 2784 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 109 PID 4076 wrote to memory of 1940 4076 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 110 PID 4076 wrote to memory of 1940 4076 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 110 PID 4076 wrote to memory of 1940 4076 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 110 PID 4676 wrote to memory of 1016 4676 18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"3⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵
- Checks computer location settings
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"7⤵PID:6080
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"8⤵PID:10116
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"8⤵PID:13820
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"8⤵PID:7888
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"7⤵PID:7536
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"8⤵PID:13188
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"8⤵PID:10424
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"7⤵PID:10208
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"7⤵PID:13796
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"7⤵PID:7828
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"7⤵PID:8580
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"8⤵PID:11104
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"7⤵PID:9908
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"7⤵PID:13676
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"7⤵PID:9192
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:6608
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"7⤵PID:12840
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"7⤵PID:10932
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:9012
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"7⤵PID:6252
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:9852
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:13896
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:1468
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:6464
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"7⤵PID:11652
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"7⤵PID:16564
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"7⤵PID:5328
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:7544
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"7⤵PID:11412
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"7⤵PID:16064
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"7⤵PID:5836
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:10192
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:13756
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:7920
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:8424
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:10020
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:13140
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:10948
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:6552
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:11668
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:16672
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:1924
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:8568
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:11400
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:9988
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:13132
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:11024
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵
- Checks computer location settings
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:5940
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"7⤵PID:11464
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"7⤵PID:16556
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"7⤵PID:5344
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:6712
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"7⤵PID:13196
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"7⤵PID:10984
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:8260
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"7⤵PID:10992
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:10036
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:13708
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:19308
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:9220
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:9828
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:13856
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:7868
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:6632
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:13220
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:876
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:9004
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:9860
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:12908
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:19332
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵
- Checks computer location settings
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:6056
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:11384
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:15532
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:6136
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:7440
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:13164
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:10888
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:10184
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:13788
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:7984
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:5124
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:10076
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:13724
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:8008
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:6568
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:13872
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:3368
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:8560
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:12592
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:9972
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:12748
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:7340
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"3⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵
- Checks computer location settings
PID:448 -
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:6048
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"7⤵PID:8544
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"8⤵PID:11008
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"7⤵PID:10004
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"7⤵PID:13880
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"7⤵PID:7040
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:7016
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"7⤵PID:13096
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"7⤵PID:11088
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:8976
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:9796
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:13920
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:4452
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:8656
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"7⤵PID:17700
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"7⤵PID:4568
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:9836
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:13936
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:7044
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:6600
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:13088
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:10664
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:8832
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:6492
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:9812
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:13928
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:7756
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵
- Checks computer location settings
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:6160
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:11392
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:16072
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:5828
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:7952
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:11756
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:16572
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:5244
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:10060
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:13888
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:19300
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:5140
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:8724
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:6436
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:9932
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:13276
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:8464
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:6640
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:13156
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:10924
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:8852
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:10640
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:9916
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:13148
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:10912
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"3⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵
- Checks computer location settings
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:5772
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:10084
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:13740
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:8440
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:6576
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:13060
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:10348
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:8884
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:17504
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:4712
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:9844
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:13652
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:8760
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:5156
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:8640
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:11408
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:9980
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:13668
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:7116
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:6792
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:13344
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:9156
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:9032
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:11188
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:9876
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:11072
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:13692
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:8076
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"3⤵
- Checks computer location settings
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:6072
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:8164
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:13944
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:7908
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:7564
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:12728
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:4528
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:10164
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:13660
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:19328
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"3⤵PID:5132
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:8588
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:9996
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:13904
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:408
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"3⤵PID:6648
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:12832
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:10728
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"3⤵PID:8664
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:11448
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"3⤵PID:9964
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"3⤵PID:14844
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"3⤵PID:6684
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"3⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵
- Checks computer location settings
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:6128
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"7⤵PID:10124
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"7⤵PID:13772
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"7⤵PID:2212
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:7356
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"7⤵PID:12736
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"7⤵PID:11176
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:10200
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:13780
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:19320
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:8352
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:10028
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:14012
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:7196
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:6624
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:13076
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:10920
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:8968
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:6456
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:9892
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:12956
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:6752
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵
- Checks computer location settings
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:5180
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:13204
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:10588
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:7372
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:12756
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:10356
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:10140
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:13804
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:3564
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:8716
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:9884
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:13684
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:5720
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:6592
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:12716
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:10724
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:8860
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:11136
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:9900
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:12896
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:9428
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"3⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:712 -
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵
- Checks computer location settings
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:5804
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:10252
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:13912
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:6916
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:7896
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:11472
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:16352
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:5548
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:10132
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:13644
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:8752
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:8404
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:11152
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:9780
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:13848
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:6932
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:6560
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:12036
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:16616
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:4880
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:8552
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:17612
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:19292
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:9788
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:12628
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:11068
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"3⤵
- Checks computer location settings
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:6120
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:10108
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:13760
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:5744
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:7652
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:13212
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:10988
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:10148
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:13840
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:6900
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"3⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:8416
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:7048
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:10012
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:12904
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:10372
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"3⤵PID:6584
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:11660
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:16852
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:5204
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"3⤵PID:8692
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"3⤵PID:9948
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"3⤵PID:14672
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"3⤵PID:6664
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"3⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵
- Checks computer location settings
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:6064
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:11056
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:12012
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:6140
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:7380
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:12648
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"6⤵PID:4496
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:9312
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:9820
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:13392
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:6756
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:10092
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:13748
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:6452
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:6616
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:13172
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:10960
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:8808
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:11120
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:9924
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:13952
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:7824
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"3⤵
- Checks computer location settings
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:6152
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:10100
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:13732
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:3108
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:7552
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:12616
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:10764
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:10156
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:13812
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:7916
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"3⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:10224
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:14004
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:6852
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"3⤵PID:6656
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:13068
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:11064
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"3⤵PID:8684
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:1224
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"3⤵PID:9956
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"3⤵PID:14020
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"3⤵PID:7232
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"3⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:6196
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:11376
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:15072
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:4504
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:7580
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:12984
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"5⤵PID:11048
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:9804
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:13832
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:7724
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"3⤵PID:5148
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:3860
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:10052
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:13864
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:4548
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"3⤵PID:6724
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:13180
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:10892
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"3⤵PID:8700
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"3⤵PID:9940
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"3⤵PID:13700
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"3⤵PID:8624
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"3⤵PID:5688
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:11456
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:15176
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:2072
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"3⤵PID:7932
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:10788
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"4⤵PID:11156
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"3⤵PID:10068
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"3⤵PID:15364
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"3⤵PID:4252
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"2⤵PID:5164
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"3⤵PID:5020
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"3⤵PID:10044
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"3⤵PID:13716
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"3⤵PID:6448
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"2⤵PID:6920
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"3⤵PID:12324
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"3⤵PID:11180
-
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"2⤵PID:8948
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"2⤵PID:9868
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"2⤵PID:13636
-
-
C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f54bb16e8c891225a48f5db6342790_NeikiAnalytics.exe"2⤵PID:6104
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\nude girls stockings .mpg.exe
Filesize1.4MB
MD53feb9e62cf68afc69c87092b7666919b
SHA1fbd616fcc7b70476d70d48d021b02e958876ee1f
SHA256b390fc3db8db661afa355578abd6669c43d64e826289d07ead06442484dcdc61
SHA512126231ac7a55c3782141e0ddbf542513f40aaad1b8357b5bc7b3ea44a263c7b13dedd6ce6db77b1074891a880709f8bef3cfe8e687320aae262dda260495458d
-
Filesize
146B
MD56d9c2047277e865e8df2fc0d016802a9
SHA1e0c6306d18e336183e444fd012a24d7f93626fb6
SHA256862561fcc69d745f1d668305ccbc21f29d3e6b759b8f2d418a70ab4f75cc9209
SHA512b70859c5d9f7ac5226d0ae933569f7ef1f05739908e6ee8a317c9fcdda0f037fdf0a3bded08dbc7abdafb39654173de81433f704607368a40b95c74edb45a8d6